Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- transaction startswith 1, endswith multiple
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all, simple question I hope.
I have a system that has one starting event with multiple outputs and I want to find out how long it takes for the system to produce each output. When I use a transaction, it only seems to give me the combination of the input and just one of the outputs, where I actually need all of the outputs.
transaction activity_id startswith=input_event_name, endswith=output_event_name
Any ideas how I can include all the the outputs? Or is there a much better way to do this?
Many thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How about using stats instead of transaction? Perhaps something like this:
... your search ...
| eval StartTime=if(searchmatch("input_event_name"),_time,null())
| eval EndTime=if(searchmatch("output_event_name"),_time,null())
| stats values(StartTime) as StartTime values(EndTime) as EndTime by activity_id
| mvexpand EndTime
| eval TransactionTime=EndTime - StartTime
This will give you the activity_id, start time, end time, and duration for every instance of output_event_name. If you need to see other information, just modify the stats statement to include it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How about using stats instead of transaction? Perhaps something like this:
... your search ...
| eval StartTime=if(searchmatch("input_event_name"),_time,null())
| eval EndTime=if(searchmatch("output_event_name"),_time,null())
| stats values(StartTime) as StartTime values(EndTime) as EndTime by activity_id
| mvexpand EndTime
| eval TransactionTime=EndTime - StartTime
This will give you the activity_id, start time, end time, and duration for every instance of output_event_name. If you need to see other information, just modify the stats statement to include it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You're very welcome, happy to help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A thousand thank yous wpreston, that worked a treat!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you provide some sample logs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't know how to handle that situation in a transaction, but perhaps this will help.
input_event_name | join activity_id max=0 overwrite=false [ search output_event_name ] | ...
If this reply helps you, Karma would be appreciated.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
