How to calculate time elapsed for (concurrent) transactions across multiple servers?

[chriscje]

I've been looking around the forums, but nothing seems to quite cover what I need.

We are currently logging stats for a conference solution, which logs start and stops times. These can be grouped as transactions, and obviously I can sum the duration. The problem is that as this is a distributed conference solution, the same conference runs on multiple nodes/servers, but the transactions only relate to a single node/server. This means I could have two transactions for the same conference, (active on different nodes/servers).

In short, we need to know how long a conference is active over a given period (say 30 days) regardless of how many nodes/servers it is active on at any point.

My search to return transactions (grouped by node and conference) is below, I just can't see how to get the active time span:

index=vmr Name=administrator.conference Message="Conference has been created." OR Message="Conference has been stopped." | transaction Conference host startswith="Conference has been created." endswith="Conference has been stopped."

[somesoni2]

How about this?

index=vmr Name=administrator.conference Message="Conference has been created." OR Message="Conference has been stopped." | transaction Conference host startswith="Conference has been created." endswith="Conference has been stopped." | sort 0 Conference _time | eventstats sum(duration) as ActiveSpan by Conference | table _time Conference host duration ActiveSpan

[somesoni2]

You should have a field call ActiveSpan available in the fieldPicker on the left. Or try the updated answer with a table command

[chriscje]

Unless I'm missing something, this doesn't appear to be giving me anything different in the results.