Splunk Search
Highlighted

Questions regarding the transaction command

Path Finder

Hello,

We have a set of log events consisting of user activity by a number of different users in an application. We are trying to construct a search that will returns only those usernames that have been active in the logs (that is log events with that username present) for more that 4 hours but did not take a break of at least 15 minutes (i.e. no activity in the logs for at least 15 minutes). I tried using the transaction command like the one shown below but it does not appear to be working. Any advise on how to accomplish this would be greatly appreciated.

sourcetype=app_sourcetype | transaction username maxspan>240m maxpause<15m

Thanks in advance.

Tags (1)
0 Karma
Highlighted

Re: Questions regarding the transaction command

Path Finder

I tried this search to get a list of all the users that were active in the logs for more than 4 hours (14400 seconds) during a day but I am not sure how I can then use this data to determine those users from this list that had maximum pauses in the logs for less than 15 minutes (did not take a break of 15 minutes or more)

sourcetype=appsourcetype | stats range(time) as difference by username | where difference > 14400

0 Karma
Highlighted

Re: Questions regarding the transaction command

Contributor

Is the search you pasted correct? The arguments to transaction do not take inequalities -- it should be something like maxspan=240m and maxpause=15m, not with > or <.