Splunk Search

How to display time parameters (start time, end time, total duration) of a transaction?

hemanath_ofc
Explorer

10/21/14 13:17:08.747 SERIAL ZPIMXTerminal.Send Start
10/21/14 13:17:08.747 SERIAL SerialComClass:**NOTICE: Serial Port cleared OK
10/21/14 13:17:08.809 **SERIAL GetAckNak Sent
: [00]
10/21/14 13:17:08.840 WLL-EX CCTX_POS_GET_TenderTypeStatus = 0

10/21/14 13:17:08.919 SERIAL SerialComClass:****NOTICE: Serial Port cleared OK
10/21/14 13:17:08.919 SERIAL Send Msg() >
10/21/14 13:17:08.981 SERIAL GetAckNak Recv: [00]

10/21/14 13:17:09.090 WLL-EX CCTX_OS_GET_TypeStatus = 0

10/21/14 13:17:09.090 SERIAL SerialComClass:**NOTICE: Serial Port cleared OK
10/21/14 13:17:09.153 **SERIAL GetAckNak Recv
: [00]
10/21/14 13:17:09.262 SERIAL SerialComClass:****NOTICE: Serial Port cleared OK
10/21/14 13:17:08.747 SERIAL ZPIMXTerminal.Send Start

in above log.. i formed a transaction using "transaction startswith="ZPIMXTerminal.Send Start" endswith="ZPIMXTerminal.Send Start"

but I'm not sure how to display time parameters. I would like to see start time of transaction, end time of transaction and total duration. Along with that, I wanted to display the start and end time of "GetAckNak " in a table. Can anyone help?

0 Karma

vasanthmss
Motivator

transaction startswith="ZPIMXTerminal.Send Start" endswith="ZPIMXTerminal.Send Start"|eval starttime=_time|eval endtime=_time+duration

If you want to convert time to human readable format use this
|convert ctime(starttime) ctime(endtime)

V

hemanath_ofc
Explorer

Thanks Vasanth..

But can i find the duration of different event within a transaction.

for expample : time between
SERIAL GetAckNak Sent: [00]

SERIAL GetAckNak Recv: [00]

0 Karma

vasanthmss
Motivator

Add a transaction command next to earlier one based on your req.

V
0 Karma

vasanthmss
Motivator

Is it working?

V
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...