Getting Data In

How to calculate the average durations and assemble this into a table/report of duration data that would cover all UserId/SessionId combos?

bhartmann
New Member

Hello,

I've looked at a lot of the duration posts (covering transaction, streamstats, etc.) -- generally these deal with very particular events, so I'm having some trouble generalizing to look at all of our durations (to then chart out ranges of durations, etc).

Some background:
All of our events have a userId (unique GUID), and then a sessionID (counts up from 1 for every new user).
The durations I am interested in are: given each userID/sessionID combo, there should be one instance (event) where eventName=Start, and one instance where eventName=End, so duration is the timestamp of the End event - timestamp of the Start event.

There is no dateTime field within our event - just using the event Timestamp in Splunk associated with each event.

I would appreciate any advice on assembling this into a table/report of duration data that would cover all UserId/SessionId combos

Thanks!

0 Karma
1 Solution

HiroshiSatoh
Champion

Is it like this?

(your search)
| transaction userId sessionID startswith=start endswith=end
| stats avg(duration) by  userId sessionID 

View solution in original post

0 Karma

HiroshiSatoh
Champion

Is it like this?

(your search)
| transaction userId sessionID startswith=start endswith=end
| stats avg(duration) by  userId sessionID 
0 Karma

bhartmann
New Member

Yes, this gets me past the first big hurdle, thank you!

Looks like from here I can play around with different visualization options. I'll do some further research into putting these results into "bins" (like "<30 sec", "30-60 sec", etc.) to then build a histogram.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...