Start timer with transaction

[Abarny]

Hi guys,

I need help cause I want start a timer when i have one values and end this same timer when this values is different.

I would use the function Transaction but i think it's not the better solution.

Exemple: When the weither have the value 2 i start the timer and when the weither take after the values 1 i stop the timer.

index="xxx" 
|fields logs{}.projectId,logs{}.newWeatherId
|transaction logs{}.projectId startswith=eval(logs{}.newWeatherId="2") endswith=eval(logs{}.newWeatherId!=2) keepevicted

Thanks for your answers.

[cmerriman]

you could try using the maxspan and maxpause options in transaction but i'm not sure that's really what you're going for.

If you're using v6.5, try using streamstats.
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Streamstats
The reset_on_change command might be what you need.

[niketn]

transaction creates a default field called duration which captures what you are intending. Just pipe

| table logs{}.projectID eventcount duration

However, better way would be to go for stats command to handle such scenarios which will perform better.