Splunk Search

Charting concurrency for all time spans

jeffa
Path Finder

I have a query that creates a transaction and then calculates the concurrency for the transactions based on the duration calculated by the 'transaction' command...

sourcetype="mySourcetype" (startEventText) OR (endEventText) | transaction host custID startswith="startEventText" endswith="endEventText" | concurrency duration=duration

I would like to chart the number of concurrent transactions over time, but when I use a standard "| timechart span=1m max(concurrency)", I see the concurrency results at the time a particular transaction started, but not for subsequent time spans. In my scenario, a transaction may take several minutes (up to hours), and I'd like a visual representation of how many of these transactions are happening at any given timespan (not just the timespans where a transaction started).

[How] Can this be done?

steveyz
Splunk Employee
Splunk Employee

try adding | filldown to the end of your search. This is available in 4.2 and later

jeffa
Path Finder

Precisely what I was looking for. Thanks! (Original)

(Edit)
Actually...this is close, but I noticed that the "score" doesn't drop off when the transaction completes.

0 Karma

sideview
SplunkTrust
SplunkTrust

you mean after the timechart span=1m max(concurrency) of course, not just after the concurrency command.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.