Splunk Search
Highlighted

How to display time parameters (start time, end time, total duration) of a transaction?

Explorer

10/21/14 13:17:08.747 SERIAL ZPIMXTerminal.Send Start
10/21/14 13:17:08.747 SERIAL SerialComClass:*NOTICE: Serial Port cleared OK
10/21/14 13:17:08.809 *
SERIAL GetAckNak Sent
: [00]
10/21/14 13:17:08.840 WLL-EX CCTXPOSGET_TenderTypeStatus = 0

10/21/14 13:17:08.919 SERIAL SerialComClass:****NOTICE: Serial Port cleared OK
10/21/14 13:17:08.919 SERIAL Send Msg() >
10/21/14 13:17:08.981 SERIAL GetAckNak Recv: [00]

10/21/14 13:17:09.090 WLL-EX CCTXOSGET_TypeStatus = 0

10/21/14 13:17:09.090 SERIAL SerialComClass:*NOTICE: Serial Port cleared OK
10/21/14 13:17:09.153 *
SERIAL GetAckNak Recv
: [00]
10/21/14 13:17:09.262 SERIAL SerialComClass:****NOTICE: Serial Port cleared OK
10/21/14 13:17:08.747 SERIAL ZPIMXTerminal.Send Start

in above log.. i formed a transaction using "transaction startswith="ZPIMXTerminal.Send Start" endswith="ZPIMXTerminal.Send Start"

but I'm not sure how to display time parameters. I would like to see start time of transaction, end time of transaction and total duration. Along with that, I wanted to display the start and end time of "GetAckNak " in a table. Can anyone help?

0 Karma
Highlighted

Re: How to display time parameters (start time, end time, total duration) of a transaction?

Motivator

transaction startswith="ZPIMXTerminal.Send Start" endswith="ZPIMXTerminal.Send Start"|eval starttime=time|eval endtime=time+duration

If you want to convert time to human readable format use this
|convert ctime(starttime) ctime(endtime)

Highlighted

Re: How to display time parameters (start time, end time, total duration) of a transaction?

Explorer

Thanks Vasanth..

But can i find the duration of different event within a transaction.

for expample : time between
SERIAL GetAckNak Sent: [00]

SERIAL GetAckNak Recv: [00]

0 Karma
Highlighted

Re: How to display time parameters (start time, end time, total duration) of a transaction?

Motivator

Add a transaction command next to earlier one based on your req.

0 Karma
Highlighted

Re: How to display time parameters (start time, end time, total duration) of a transaction?

Motivator

Is it working?

0 Karma