Splunk Search

Concurrent Event Count (without transactions)

polfer
Explorer

I have a collection of individual log lines where each event contains a start time and a duration for an individual request. I would like to setup a dashboard that includes the count of concurrent (overlapping) events over time. I don't believe transaction will help (individual lines, so can't use duration there). Also, concurrency as I see it referenced elsewhere tracks the number of events that "start" within a particular period, not the events that overlap based start_time + duration as defined in the log line itself.

Sorry if this is an obvious question for the pros (very new to splunk), but any ideas or starting points would be appreciated! Thank you!

DanP

gkanapathy
Splunk Employee
Splunk Employee

I don't know where you're seeing references to "concurrency", but this is exactly what the "concurrency" search command does: http://www.splunk.com/base/Documentation/latest/SearchReference/Concurrency

polfer
Explorer

I may have let myself get swayed by another answers post that said ". . . concurrency isn't the number of events that occurred during any overlap, but rather the number of events that occurred simultaneously at the start time of the event." I'll try it again with some clearer test cases. Thanks for the feedbakc.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>