I have logs which show a transaction with clear startswith and endswith tabling the duration taken like so
source=*.csv | transaction E2ETxnSeq startswith="StartInbound" endswith="EndInbound" | table duration
I'm looking for finding the latency between transactions (or actually the idle time between traansactions) so how do I pipe the above output to calculate the delta ?
Thanks
actually they occasionally can but i can ignore those cases
If transactions do not overlap, I imagine you could use delta
for this.
source=*.csv | transaction E2ETxnSeq startswith="StartInbound" endswith="EndInbound" | delta _time AS transactionlatency | eval transactionlatency=-transactionlatency | table duration transactionlatency
I've tried this and transactionlatency is always 0 which doesnt match our data set. Still checking
Can transactions overlap?