Splunk Search

Start timer with transaction

Abarny
Path Finder

Hi guys,

I need help cause I want start a timer when i have one values and end this same timer when this values is different.

I would use the function Transaction but i think it's not the better solution.

Exemple: When the weither have the value 2 i start the timer and when the weither take after the values 1 i stop the timer.

index="xxx" 
|fields logs{}.projectId,logs{}.newWeatherId
|transaction logs{}.projectId startswith=eval(logs{}.newWeatherId="2") endswith=eval(logs{}.newWeatherId!=2) keepevicted

Thanks for your answers.

0 Karma

cmerriman
Super Champion

you could try using the maxspan and maxpause options in transaction but i'm not sure that's really what you're going for.

If you're using v6.5, try using streamstats.
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Streamstats
The reset_on_change command might be what you need.

0 Karma

niketnilay
Legend

transaction creates a default field called duration which captures what you are intending. Just pipe

| table logs{}.projectID eventcount duration

However, better way would be to go for stats command to handle such scenarios which will perform better.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!