Getting Data In

How to calculate the average durations and assemble this into a table/report of duration data that would cover all UserId/SessionId combos?

bhartmann
New Member

Hello,

I've looked at a lot of the duration posts (covering transaction, streamstats, etc.) -- generally these deal with very particular events, so I'm having some trouble generalizing to look at all of our durations (to then chart out ranges of durations, etc).

Some background:
All of our events have a userId (unique GUID), and then a sessionID (counts up from 1 for every new user).
The durations I am interested in are: given each userID/sessionID combo, there should be one instance (event) where eventName=Start, and one instance where eventName=End, so duration is the timestamp of the End event - timestamp of the Start event.

There is no dateTime field within our event - just using the event Timestamp in Splunk associated with each event.

I would appreciate any advice on assembling this into a table/report of duration data that would cover all UserId/SessionId combos

Thanks!

0 Karma
1 Solution

HiroshiSatoh
Champion

Is it like this?

(your search)
| transaction userId sessionID startswith=start endswith=end
| stats avg(duration) by  userId sessionID 

View solution in original post

0 Karma

HiroshiSatoh
Champion

Is it like this?

(your search)
| transaction userId sessionID startswith=start endswith=end
| stats avg(duration) by  userId sessionID 
0 Karma

bhartmann
New Member

Yes, this gets me past the first big hurdle, thank you!

Looks like from here I can play around with different visualization options. I'll do some further research into putting these results into "bins" (like "<30 sec", "30-60 sec", etc.) to then build a histogram.

0 Karma
Get Updates on the Splunk Community!

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...