Splunk Search

Concurrent Event Count (without transactions)


I have a collection of individual log lines where each event contains a start time and a duration for an individual request. I would like to setup a dashboard that includes the count of concurrent (overlapping) events over time. I don't believe transaction will help (individual lines, so can't use duration there). Also, concurrency as I see it referenced elsewhere tracks the number of events that "start" within a particular period, not the events that overlap based start_time + duration as defined in the log line itself.

Sorry if this is an obvious question for the pros (very new to splunk), but any ideas or starting points would be appreciated! Thank you!


Splunk Employee
Splunk Employee

I don't know where you're seeing references to "concurrency", but this is exactly what the "concurrency" search command does: http://www.splunk.com/base/Documentation/latest/SearchReference/Concurrency


I may have let myself get swayed by another answers post that said ". . . concurrency isn't the number of events that occurred during any overlap, but rather the number of events that occurred simultaneously at the start time of the event." I'll try it again with some clearer test cases. Thanks for the feedbakc.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...