Splunk Search

How to create a visualization showing event counts since beginning of the transaction, separated by time?

archier
New Member

I have transactions with varying number of events. I want a plot showing how many events occur in buckets since the beginning of the transaction, e.g. how many events in the first 5 seconds, next 5 seconds, etc.

How can I do this?

0 Karma

sundareshr
Legend

Lets assume you transactions are grouped by a txn_id. See if this is what you're looking for...

index=foo sourcetype=bar | bin span=5s _time | stats count by txn_id _time
0 Karma

archier
New Member

thanks sundareshr, it doesn't quite work, there are many transactions starting at different times

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...