Determining count and duration between eventtypes

[marquiselee]

Hi

So I have logs indexed in spunk that describe several steps in a workflow. The logs contain information on many tasks that make up this workflow. Each task is given a unique Task_ID. They looks a bit like this…

Time	TaskID	TaskStatus
2012-04-25 12:23:34	[1343077113556]	StartEncodeTask
2012-04-25 01:13:14	[1343214875758]	StartCopyTask
2012-04-25 01:21:22	[1343412154542]	StartMoveTask

I've created Eventtypes to Identify when these Tasks Begin. e.g. eventtype="EncodeStart" I also have identified when ANY task completes… However there is no indication of the type of task that was completed. I've made an eventtype called 'TaskComplete' to identify these.

Time	Task_ID	Task_Status
2012-04-25 12:29:14	[1343077113556]	TaskComplete
2012-04-25 01:14:36	[1343214875758]	TaskComplete
2012-04-25 01:22:41	[1343412154542]	TaskComplete

The only thing linking the start task to the end task is the "TASK_ID"

So my issue is how can I get spunk to spit out the # of Successful Completed Tasks for each Task type in a given hour period AND on average how long did each task type take to complete?

e.g.

TASK	#COMPLETED	AVG TIME TO COMPLETE
EncodeTask	241	2min41sec

Any help with this would be terrific.

[sdaniels · Accepted solution]

A good start might be using the transaction command.

... | transaction Task_ID

You'll have a duration of the overall transaction and you can specify what an expected transaction should start and end with. You'll find quite a few transaction questions on splunkbase.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchfortransactions?r=searchtip

Previous splunkbase answer:

http://splunk-base.splunk.com/answers/4381/can-splunk-help-me-further-analyzerefine-the-durations-of...