Getting Data In

How to calculate the average durations and assemble this into a table/report of duration data that would cover all UserId/SessionId combos?

bhartmann
New Member

Hello,

I've looked at a lot of the duration posts (covering transaction, streamstats, etc.) -- generally these deal with very particular events, so I'm having some trouble generalizing to look at all of our durations (to then chart out ranges of durations, etc).

Some background:
All of our events have a userId (unique GUID), and then a sessionID (counts up from 1 for every new user).
The durations I am interested in are: given each userID/sessionID combo, there should be one instance (event) where eventName=Start, and one instance where eventName=End, so duration is the timestamp of the End event - timestamp of the Start event.

There is no dateTime field within our event - just using the event Timestamp in Splunk associated with each event.

I would appreciate any advice on assembling this into a table/report of duration data that would cover all UserId/SessionId combos

Thanks!

0 Karma
1 Solution

HiroshiSatoh
Champion

Is it like this?

(your search)
| transaction userId sessionID startswith=start endswith=end
| stats avg(duration) by  userId sessionID 

View solution in original post

0 Karma

HiroshiSatoh
Champion

Is it like this?

(your search)
| transaction userId sessionID startswith=start endswith=end
| stats avg(duration) by  userId sessionID 
0 Karma

bhartmann
New Member

Yes, this gets me past the first big hurdle, thank you!

Looks like from here I can play around with different visualization options. I'll do some further research into putting these results into "bins" (like "<30 sec", "30-60 sec", etc.) to then build a histogram.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...