Splunk Search

Time difference within a transaction command

Path Finder

I have a search that uses the transaction:

 

| transaction startswith=<...> endswith=<...>

 

 Command to group it into certain events I want to see. How would I search this even further to get the time difference between each event in this transaction and then graph these time differences to a line/bar graph with the events/hosts on X-axis and time on y-axis. There are no specific fields for each event that I want to use to calculate the time difference, I only want to show the time difference between each and every raw log in this transaction.

Labels (3)
0 Karma

SplunkTrust
SplunkTrust
The duration field shows the time difference between the first and last events in the transaction. To get the deltas between individual events you'll have to parse the transaction.
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

@richgalloway 

What would that command look like then? I have been trying to parse the transactions but haven't been able to find a working command that calculates the delta times.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!