Splunk Search

Need Help to find duration of transaction

sanyonhhh
New Member

Query used:

index=[server]| transaction Extract startswith="Value Extract Starting." endswith="extraction completed."

Log Result:

1 » 10/4/13 11:39:58.000 PM

2013-10-04T19:39:58 Extract STATUS Value Extract Starting.

2013-10-04T19:40:02 Extract STATUS extraction completed.

2 » 10/4/13 11:10:15.000 PM

2013-10-04T19:10:15 Extract STATUS Value Extract Starting.

2013-10-04T19:10:21 Extract STATUS extraction completed.

Need to find the time difference in a transaction for start and end line. Time is present in both the lines.
Eg: From the first event i should get time differnce from 2013-10-04T19:39:58 and 2013-10-04T19:40:02 and should plot it as x-axis day and y-axis time difference.

0 Karma
1 Solution

MuS
Legend

Hi sanyonhhh

the transaction command should provide you with a field called duration which is time in seconds for your transaction. But, it could be a floating point value for partial seconds if you have subseconds in your timestamps.

you can use eval to create a human readable time out of it like this

| eval myTime=tostring(duration,"duration")

hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi sanyonhhh

the transaction command should provide you with a field called duration which is time in seconds for your transaction. But, it could be a floating point value for partial seconds if you have subseconds in your timestamps.

you can use eval to create a human readable time out of it like this

| eval myTime=tostring(duration,"duration")

hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...