Splunk Search

How to get transaction count between 5-10 10-15?

karthi2809
Builder

How to get transaction count between 5-10sec 10-15sec as table ?

Expected :

Total   Success Failure 0-5 Secs    5-10 Secs   10-15 Secs  >15 Secs
 50             40  10             25             15                            5                5
 60             40  20             45               5                           5                5

my query:

index = "test"       | eval TransactionTime=TransactionSentEndtime - TransactionReceivedStartTime | eval TransactionTime=round((TransactionTime/1000),3)  |eventstats count(eval(Proxy)) as "totcnt" count(eval(Status="500" OR Status="502" OR Status="503" OR Status="504" OR Status="4*")) as "failurecnt" count(eval(Status=200)) as "success" by Sender|stats values(totcnt) as TotalCount values(failurecnt) as FailureCount values(success) as SuccessCount    by  Sender
0 Karma
1 Solution

woodcock
Esteemed Legend

You should be able to add this to the bottom:

| eval diff = $5-10 Secs$ - $10-15 Secs$

View solution in original post

woodcock
Esteemed Legend

You should be able to add this to the bottom:

| eval diff = $5-10 Secs$ - $10-15 Secs$
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...