Parsing events within a transaction

[gwu]

Here's my search string:

host=abc* source="/log...*" | rex "^[\d|-]+ [\d|:|,]+ (?P<Identifier>[\w\w|_]+)\s" | transaction Company startswith="HelloPhrase" endswith="GoodbyePhrase" | timechart useother=F avg(eval(duration/60)) by Identifier

Within the start/end events, I want to parse and then extract the max of a number that appears within another event and additional information provided there. I've tried to illustrate what I'm looking for...

StartEvent...

Event1 [Number 1, processing size 100]...

Event2...additional information

Event45 [Number 7, processing size 50]...

EndEvent

I want to know how long it takes to complete the task and what the max number is along with the processing size of that event. Any suggestions would be greatly appreciated.

[yannK]

Look at the automatic fields populated by the transaction :
- duration
- eventcount

see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

If you want to also distinguish all the values for the events, the individual fields will be turned into multivalue fields,
you can use the multivalue functions like mvcount()

see http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsemultivaluefields

[kristian_kolb]

Hmm some more information, incl sample events would probably be helpful.

For a transaction, the duration field is calculated automatically. Assuming that you extract "Number" as in your pseudo events, somthing like the following to replace the timechart part;

... | stats max(Number) first(duration) by _time

/K