Find th duration of the transaction of the particular task

[splunkpoornima]

hi i used the below query..

--|transaction Taskaction startswith=START endswith=Succeeded|table Taskaction duration

i got the duration for each and every task..as

TaskAction duration

task1 12

task2 4.2

task3 13

task4 76

if i want to filter task1 and its duration..how to do that

plz help

[Ayn · Accepted solution]

Are you asking about how to use the search command?

... | transaction Taskaction startswith=START endswith=Succeeded|table Taskaction duration | search TaskAction=task1

Also, if this is what you were after, may I suggest that you take the Splunk introduction tutorial.