Splunk Search
Highlighted

How do I get my transaction search to use the first start event as the starting point?

New Member

Hi,
i have log file
and i am using startswith Starting Dispatcher and endswith completed.
but some times in the log there are 2 Starting dispatcher, so i want the transaction to consider first start , so that i will get correct duration.

appreciate help.

Thanks,
Jai

0 Karma
Highlighted

Re: How do I get my transaction search to use the first start event as the starting point?

Communicator

Can you give me an example of the search you're currently using and I'll see if I can rework it to use stats instead of transaction. Transaction is a very costly search command, and you will almost always get better performance using stats instead.

0 Karma
Highlighted

Re: How do I get my transaction search to use the first start event as the starting point?

Ultra Champion
index=your_index sourcetype=your_sourcetype  "Starting Dispatcher" OR "completed"
| streamstats count(eval("Starting Dispatcher")) as session by transaction_keyword
| stats earliest(_time) as start latest(_time) as end range(_time) as duration count as flag by transaction_keyword session
| where flag > 1

Hi, @jaihindnalla
_start
, end , duration are UNIX epoch time.
you can use convert or strftime

0 Karma