Splunk Search

Charting concurrency for all time spans

jeffa
Path Finder

I have a query that creates a transaction and then calculates the concurrency for the transactions based on the duration calculated by the 'transaction' command...

sourcetype="mySourcetype" (startEventText) OR (endEventText) | transaction host custID startswith="startEventText" endswith="endEventText" | concurrency duration=duration

I would like to chart the number of concurrent transactions over time, but when I use a standard "| timechart span=1m max(concurrency)", I see the concurrency results at the time a particular transaction started, but not for subsequent time spans. In my scenario, a transaction may take several minutes (up to hours), and I'd like a visual representation of how many of these transactions are happening at any given timespan (not just the timespans where a transaction started).

[How] Can this be done?

steveyz
Splunk Employee
Splunk Employee

try adding | filldown to the end of your search. This is available in 4.2 and later

jeffa
Path Finder

Precisely what I was looking for. Thanks! (Original)

(Edit)
Actually...this is close, but I noticed that the "score" doesn't drop off when the transaction completes.

0 Karma

sideview
SplunkTrust
SplunkTrust

you mean after the timechart span=1m max(concurrency) of course, not just after the concurrency command.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...