How to calculate the average durations and assemble this into a table/report of duration data that would cover all UserId/SessionId combos?

[bhartmann]

Hello,

I've looked at a lot of the duration posts (covering transaction, streamstats, etc.) -- generally these deal with very particular events, so I'm having some trouble generalizing to look at all of our durations (to then chart out ranges of durations, etc).

Some background:
All of our events have a userId (unique GUID), and then a sessionID (counts up from 1 for every new user).
The durations I am interested in are: given each userID/sessionID combo, there should be one instance (event) where eventName=Start, and one instance where eventName=End, so duration is the timestamp of the End event - timestamp of the Start event.

There is no dateTime field within our event - just using the event Timestamp in Splunk associated with each event.

I would appreciate any advice on assembling this into a table/report of duration data that would cover all UserId/SessionId combos

Thanks!

[HiroshiSatoh · Accepted solution]

Is it like this?

(your search)
| transaction userId sessionID startswith=start endswith=end
| stats avg(duration) by  userId sessionID 

[bhartmann]

Yes, this gets me past the first big hurdle, thank you!

Looks like from here I can play around with different visualization options. I'll do some further research into putting these results into "bins" (like "<30 sec", "30-60 sec", etc.) to then build a histogram.