Getting Data In

Transaction using timestamp

Sriram
Communicator

I have the following query.
index="someindex" | sort +evnt_ts | transaction dcn,evnt_ts keepevicted="t"| table dcn,_time,evnt_ts

There are 15 events for each dcn. When I do 'transaction dcn', I get the results properly with evnt_ts grouped together. I need to results come in ascending time sequence as I want to use 'delta' command to find the time difference between each events. When I run the above query, the timestamp is always in reverse order (most recent time first). I even tried |reverse. Nothing works. Any luck.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have you tried '... | sort -evnt_ts | ...'?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Have you tried '... | sort -evnt_ts | ...'?

---
If this reply helps you, Karma would be appreciated.

Sriram
Communicator

Yes. I got the same result with event_ts, how sort using _time helped.I managed to make it work by specifying "startwith" as well as with those sort as there are many similar transaction with same dcn. Thanks again.

index="someindex" | transaction dcn startswith="020"| eval "Response Time(Secs)" = round(duration,2) | eval "Event Time"=strftime(_time, "%m-%d-%Y %H:%M:%S") | rename rcvd_dt as "Received Date" dcn as DCN | table "Event Time", "Received Date" , DCN, , "Response Time(Secs)" | sort -"Event Time"

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...