Splunk Search
Highlighted

Is the duration field always in seconds? (transaction command)

Builder

Greetings everyone,
I just want to verify that the transaction generated duration field is always in seconds. it doesn't say definitively in the transaction guide. The examples below allude to it being in seconds, but I'm not entirely sure. Any advice would be helpful, thanks!

Tags (1)
0 Karma
Highlighted

Re: Is the duration field always in seconds? (transaction command)

SplunkTrust
SplunkTrust

Yes, it is always seconds. But, it could be a floating point value for partial seconds if you have subseconds in your timestamps.

View solution in original post

Highlighted

Re: Is the duration field always in seconds? (transaction command)

Builder

Thanks, that's exactly what I needed to know!

0 Karma
Highlighted

Re: Is the duration field always in seconds? (transaction command)

Communicator

Would a condition of duration>300,000,000 make sense, seeing as how that is 9.5 years? Splunk ships with certain pre-built queries for ES, and one of them had that condition. The query was titled 'Long Lived Connections' but that sort of seems ridiculous to me. I know this question is old but it seems the most relevant and I would hate to open a whole new question if I can get a quick answer here.

Thank you!

0 Karma