Splunk Search

Concurrent Event Count (without transactions)


I have a collection of individual log lines where each event contains a start time and a duration for an individual request. I would like to setup a dashboard that includes the count of concurrent (overlapping) events over time. I don't believe transaction will help (individual lines, so can't use duration there). Also, concurrency as I see it referenced elsewhere tracks the number of events that "start" within a particular period, not the events that overlap based start_time + duration as defined in the log line itself.

Sorry if this is an obvious question for the pros (very new to splunk), but any ideas or starting points would be appreciated! Thank you!


Splunk Employee
Splunk Employee

I don't know where you're seeing references to "concurrency", but this is exactly what the "concurrency" search command does: http://www.splunk.com/base/Documentation/latest/SearchReference/Concurrency


I may have let myself get swayed by another answers post that said ". . . concurrency isn't the number of events that occurred during any overlap, but rather the number of events that occurred simultaneously at the start time of the event." I'll try it again with some clearer test cases. Thanks for the feedbakc.

0 Karma
Get Updates on the Splunk Community!

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...