Concurrent Event Count (without transactions)

[polfer]

I have a collection of individual log lines where each event contains a start time and a duration for an individual request. I would like to setup a dashboard that includes the count of concurrent (overlapping) events over time. I don't believe transaction will help (individual lines, so can't use duration there). Also, concurrency as I see it referenced elsewhere tracks the number of events that "start" within a particular period, not the events that overlap based start_time + duration as defined in the log line itself.

Sorry if this is an obvious question for the pros (very new to splunk), but any ideas or starting points would be appreciated! Thank you!

DanP

[gkanapathy]

I don't know where you're seeing references to "concurrency", but this is exactly what the "concurrency" search command does: http://www.splunk.com/base/Documentation/latest/SearchReference/Concurrency

[polfer]

I may have let myself get swayed by another answers post that said ". . . concurrency isn't the number of events that occurred during any overlap, but rather the number of events that occurred simultaneously at the start time of the event." I'll try it again with some clearer test cases. Thanks for the feedbakc.