Splunk Search

Count the number of events in between a recurring event

Path Finder

I have an event "trans" occurs from time to time, I want to be able to count the number of another type of events (say "down") occur in between this recurring event "trans".

What I tried is

link OR down | transaction endswith="trans" | stats count

Which actually gives me counts of transactions, rather than number of "down" events in between "trans" events.

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

The transaction command adds the eventcount field. I'd try:

link OR down | transaction endswith="trans" | stats avg(eventcount)

Or if you like:

link OR down | transaction endswith="trans" | table _time duration eventcount

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

The transaction command adds the eventcount field. I'd try:

link OR down | transaction endswith="trans" | stats avg(eventcount)

Or if you like:

link OR down | transaction endswith="trans" | table _time duration eventcount

View solution in original post

0 Karma