Splunk Search

Start timer with transaction

Abarny
Path Finder

Hi guys,

I need help cause I want start a timer when i have one values and end this same timer when this values is different.

I would use the function Transaction but i think it's not the better solution.

Exemple: When the weither have the value 2 i start the timer and when the weither take after the values 1 i stop the timer.

index="xxx" 
|fields logs{}.projectId,logs{}.newWeatherId
|transaction logs{}.projectId startswith=eval(logs{}.newWeatherId="2") endswith=eval(logs{}.newWeatherId!=2) keepevicted

Thanks for your answers.

0 Karma

cmerriman
Super Champion

you could try using the maxspan and maxpause options in transaction but i'm not sure that's really what you're going for.

If you're using v6.5, try using streamstats.
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Streamstats
The reset_on_change command might be what you need.

0 Karma

niketnilay
Legend

transaction creates a default field called duration which captures what you are intending. Just pipe

| table logs{}.projectID eventcount duration

However, better way would be to go for stats command to handle such scenarios which will perform better.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.