Splunk Search

Is it possible to get duration in milliseconds when charting a transaction

tomhowe
New Member

We are pushing in [json] events with a timestamp field that contains time since epoch in milliseconds, eg:
{[-]
name : "fetch.thing",
correlationId: 'xyz',
timestamp : 1366040759635
}

when I try to do query :
* | spath name | transaction correlationId | chart max(duration) by correlationId

The durations are all 0 despite the timestamps not being the same.
I suspect this is because the duration is in seconds.

Is this the case?

If so, is it possible to display duration in milliseconds?

Thanks, Tom

Tags (1)
0 Karma

Ayn
Legend

As far as I know you can only get durations in seconds from the transaction command. But, transaction is expensive and can often be replaced with stats like this in this case. And, you get the benefit of solving your problem while you're at it 🙂

This should do it (obviously untested though):

* | spath | stats range(timestamp) as durationms by correlationId | eval duration=durationms/1000
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...