Splunk Search

Concurrency count

Influencer

(Love this forum. Didn't even know about the concurrency command before this morning. 🙂

My search:

SYSCODE=ezLMWeb* | transaction EZ_GUID maxspan=60 | concurrency duration=duration

All seems well. But how does splunk count concurrent events? My confustion started when I noticed in my results there are 2 events that had concurrency of 18. Shouldn't the number of concurrent events be at least 18? What's the logic behind only 2 events that ran alongside 16 other events at the same time? I'm sure I'm missing something fairly simple. 😕

Thanks, Jon

(Doh! No 'concurrency' tag yet.)

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Yes, concurrency isn't the number of events that occurred during any overlap, but rather the number of events that occurred simultaneously at the start time of the event.

View solution in original post

Splunk Employee
Splunk Employee

Yes, concurrency isn't the number of events that occurred during any overlap, but rather the number of events that occurred simultaneously at the start time of the event.

View solution in original post

Influencer

It appears to tally concurrent event counts as it runs through them. I zoomed in on the 18 count spike, and I see events with counts 1-18, in order of time started.

0 Karma

Super Champion

There is now. (I added the "concurrency" tag for you. Once you get a certain number of reputation points you are allowed to create new tags.)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!