Getting Data In

How to calculate the average durations and assemble this into a table/report of duration data that would cover all UserId/SessionId combos?

bhartmann
New Member

Hello,

I've looked at a lot of the duration posts (covering transaction, streamstats, etc.) -- generally these deal with very particular events, so I'm having some trouble generalizing to look at all of our durations (to then chart out ranges of durations, etc).

Some background:
All of our events have a userId (unique GUID), and then a sessionID (counts up from 1 for every new user).
The durations I am interested in are: given each userID/sessionID combo, there should be one instance (event) where eventName=Start, and one instance where eventName=End, so duration is the timestamp of the End event - timestamp of the Start event.

There is no dateTime field within our event - just using the event Timestamp in Splunk associated with each event.

I would appreciate any advice on assembling this into a table/report of duration data that would cover all UserId/SessionId combos

Thanks!

0 Karma
1 Solution

HiroshiSatoh
Champion

Is it like this?

(your search)
| transaction userId sessionID startswith=start endswith=end
| stats avg(duration) by  userId sessionID 

View solution in original post

0 Karma

HiroshiSatoh
Champion

Is it like this?

(your search)
| transaction userId sessionID startswith=start endswith=end
| stats avg(duration) by  userId sessionID 
0 Karma

bhartmann
New Member

Yes, this gets me past the first big hurdle, thank you!

Looks like from here I can play around with different visualization options. I'll do some further research into putting these results into "bins" (like "<30 sec", "30-60 sec", etc.) to then build a histogram.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...