Reporting on multiple transactions

[bruceat]

Hi all,

I want to track the duration of individual steps of a larger transaction. For example, I have :

2014-02-05 20:01:25 lcid=12345 Starting transaction 
2014-02-05 20:01:31 lcid=12345 Starting step A
2014-02-05 20:01:38 lcid=12345 Finished step A
2014-02-05 20:01:40 lcid=12345 Something else
2014-02-05 20:01:41 lcid=12345 Starting step B
2014-02-05 20:01:48 lcid=12345 Finished step B
2014-02-05 20:01:51 lcid=12345 Starting step C
2014-02-05 20:01:51 lcid=67890 Something else again
2014-02-05 20:01:58 lcid=12345 Finished step C
2014-02-05 20:02:00 lcid=12345 Finished transaction 

What I would like to do is to extract "step A", "step B" and "step C" durations individually.

I can do this for a single step easily enough with:
transaction lcid startswith="Starting step A" endswith="Finished step A"

Is there a way to get the duration for each of the three steps?

Thanks

[somesoni2]

Try this.

..your main search..| rex "lcid=[\d]*\s(?<status>[^ ]*)\s(step |trans)(?<actor>[^ ]*)" | eval actor=if(actor="action","Main",actor) | transaction actor startswith="Starting" endswith="Finished"