Splunk Search

Extract the 2nd event time in a transaction

ICAP_RND
Engager

When using transaction, SPLUNK always use _time of the 1st event
I need to extract the time of the second event in a transaction
I tried to use Time=_time+duration, however the result sometimes is not accurate
I have used the following transaction command:
index=clientlogs FailedApp=* OR "WorkflowServer.CloseApplication * pid:" 4104 | rex field=Message.Text "pid: (?\d+)"| transaction AppPID host startswith="WorkflowServer.CloseApplication * pid:" endswith="Application * failed" maxspan=60s mvlist=t| eval Time=_time+duration | eval date = strftime(Time, "%Y-%m-%d %H:%M:%S.%2N")
1st event time: 2017-01-07 11:01:13.10
2nd event time: 2017-01-07 11:01:16.39
duration: 2.39 sec
The sum result is: 2017-01-07 11:01:16.40

  1. Is there a better way to extract the second event timestamp?
  2. If not, is there a way to fix this issue?

see results in the attached file
alt text

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can always run strptime() on the nth multivalue-member of the Message.Date field to parse its timestamp after the transaction.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can always run strptime() on the nth multivalue-member of the Message.Date field to parse its timestamp after the transaction.

0 Karma

ICAP_RND
Engager

The best workaround is as follows:
index=clientlogs FailedApp=* OR "WorkflowServer.CloseApplication * pid:" | rex field=Message.Text "pid: (?\d+)"| transaction AppPID host startswith="WorkflowServer.CloseApplication * pid:" endswith="Application * failed" maxspan=60s mvlist=t | convert timeformat="%Y-%m-%d %H:%M:%S.%2N" mktime(Message.Date) as Date | eval DD=strftime(mvindex(Date,1), "%Y-%m-%d %H:%M:%S.%2N")

but if someone has an answer to my questions above, I'll be glad to know

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I've see the _time value being rounded up some times and that's what is showing it there (milliseconds being rounded off). See if this helps in the query that you've in your question

... | eval Time=_time+duration*1.00000 |...

Also, for your current working solution can be simplified as this (as the format of date is same in convert and strftime)

index=clientlogs FailedApp= OR "WorkflowServer.CloseApplication pid:" | rex field=Message.Text "pid: (?<AppPID>\d+)"| transaction AppPID host startswith="WorkflowServer.CloseApplication pid:" endswith="Application failed" maxspan=60s mvlist=t | eval DD=mvindex('Message.Date',1)

ICAP_RND
Engager

Thanks Martin
This workaround works
However, I want to know if I can use a direct method to extract the second event timestamp, and if not why duration is not working all the time

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...