So i'm working for a manufacturing company and have managed to index all logs (good Start). I have an order number (say Order X150) and when typing in Splunk, i can see all the different source types it traverses. As an example:
I can see that the order route has 200 events and I want to analyze how long the order takes between each source type (sometimes the journey can go from sourcetype 4 to sourcetype 1 to check something then back to sourcetype4.
What's the best way of getting the latency between all the events in the journey, a kind of way so you can see the full routing history for a given order ? Thanks so much team!
The transaction command adds two fields to the raw events, duration and eventcount. The values in the duration field show the difference between the timestamps for the first and last events in the transaction. The values in the eventcount field show the number of events in the transaction.