Splunk Search
Highlighted

How to find the duration of overlapping transactions

Path Finder

Ok,

I have two or more transactions like this:

Host:abc12301 start:08:00 end:10:00
Host:abc123
02 start:09:05 end:11:00

If you look the time windows of the transactions overlap. I would like to be able to calculate the duration of the overlap itself.

Not sure if there is an automated way.

Any help would be appreciated,
Rcp

0 Karma
Highlighted

Re: How to find the duration of overlapping transactions

SplunkTrust
SplunkTrust

Will you always have only two events to match up?

If you will have more than two, will you have them already correlated (like with a transaction command)?

0 Karma
Highlighted

Re: How to find the duration of overlapping transactions

Splunk Employee
Splunk Employee

Hey @raynold.peterson, don't forget to accept an answer if one of these solutions worked for you. 🙂 Everyone loves karma points! Happy Splunking!

0 Karma
Highlighted

Re: How to find the duration of overlapping transactions

SplunkTrust
SplunkTrust

Adapt one of these -

https://answers.splunk.com/answers/513002/how-to-graph-sum-of-overlapping-values-given-start.html#an...
https://answers.splunk.com/answers/565112/suggestions-for-charting-backlogs-by-month.html

The basic idea is to break each transaction into two - one that +1s the count at the start, and one that -1s the count at the end. In your use case, any increment of time where the total open count is 2 or more is a unit of overlap.

Highlighted

Re: How to find the duration of overlapping transactions

Esteemed Legend

You can do some crazy stuff with concurrency:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Concurrency

Search for woodcock splunk answers concurrency and maybe something that I have written before will get you going.

Highlighted

Re: How to find the duration of overlapping transactions

Esteemed Legend
0 Karma