Splunk Search

How to calculate timespan of a field value as session-duration only for a specific sourcetype ?

New Member

I need to extract the session-duration from different BI server logs. Most BI server logs have clearly defined session-duration fields you can extract by defining extraction logic in props.conf but for one server log, I have to calculate the session using transaction with session id as the field and using eval to assign the duration as session-duration.
But can I do this for only a specific sourcetype ? If not can I do this in the props.conf ?

0 Karma


I think, in props.conf it is not possible. You can try something like this in search

Some search terms... | transaction sessionId | eval SessionDuration = case(sourcetype!="A",SessionDuration,sourcetype=="A",SET-SST)| Other search terms

where SET is 'Session End Time' and SST is 'Session Start Time'

0 Karma