Splunk Search

Concurrency count

twinspop
Influencer

(Love this forum. Didn't even know about the concurrency command before this morning. 🙂

My search:

SYSCODE=ezLMWeb* | transaction EZ_GUID maxspan=60 | concurrency duration=duration

All seems well. But how does splunk count concurrent events? My confustion started when I noticed in my results there are 2 events that had concurrency of 18. Shouldn't the number of concurrent events be at least 18? What's the logic behind only 2 events that ran alongside 16 other events at the same time? I'm sure I'm missing something fairly simple. 😕

Thanks, Jon

(Doh! No 'concurrency' tag yet.)

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes, concurrency isn't the number of events that occurred during any overlap, but rather the number of events that occurred simultaneously at the start time of the event.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes, concurrency isn't the number of events that occurred during any overlap, but rather the number of events that occurred simultaneously at the start time of the event.

twinspop
Influencer

It appears to tally concurrent event counts as it runs through them. I zoomed in on the 18 count spike, and I see events with counts 1-18, in order of time started.

0 Karma

Lowell
Super Champion

There is now. (I added the "concurrency" tag for you. Once you get a certain number of reputation points you are allowed to create new tags.)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...