Splunk Search

How do you calculate concurrency by second from start time and duration?

nacartwright
New Member

Newbie here...I have an index of data that represents calls. Each event has a start_time and duration. I've been asked to take all of these events and to calculate how many concurrent calls there are per second. It was suggested that I use Python and split the calls into different rows of a DB but that sounds tedious.

Is there a way to take each events data with start time and duration and chunk it up into seconds like this...?

0 Karma
1 Solution

datasearchninja
Communicator

See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Concurrency

Assuming that the starttime is in field '_time', and the duration is in the field duration, to get the number of concurrent calls at that event, then bucket _time per second to find the maximum concurrency per second:

index=data ...
| concurrency start=_time duration=duration
| bin _time span=1s
| stats max(concurrency) as concurrency by _time

View solution in original post

0 Karma

datasearchninja
Communicator

See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Concurrency

Assuming that the starttime is in field '_time', and the duration is in the field duration, to get the number of concurrent calls at that event, then bucket _time per second to find the maximum concurrency per second:

index=data ...
| concurrency start=_time duration=duration
| bin _time span=1s
| stats max(concurrency) as concurrency by _time
0 Karma

nacartwright
New Member

We're after the number of active calls at any given time. So, if at 12:03:01 there are 5 active calls and at 12:03:02 one ends we need it to show 4 calls. Will this get us there?

0 Karma

nacartwright
New Member

Perfect! Ran through Power BI too (took WAAAY longer) and got the same numbers. Thanks!

0 Karma

datasearchninja
Communicator

yes, this would show that.

0 Karma

renjith_nair
Legend

@nacartwright,

You shall use Concurrency command. It has the option for duration in secs

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...