Splunk Search

Transaction and Duration


Hi all!

Does transaction calculate duration per "transaction" or from the first event in the transaction to the last event in the last transaction (active - #1 to Inactive - #2)? I need to average the sum of all durations of EACH transaction.

sourcetype=app | transaction userA startswith=eval(active) endswith=(inactive) | stats avg(duration) | eval duration = tostring(duration,"duration")

active - #1
inactive - #1
(duration #1)

(Time of Inactivity is disregarded)

active - #2
Inactive - #2
(duration #2)

Sum = Duration #1 + Duration #2 = what I need

I couldn't find this in the docs. As a sub question how can I remove HH and SSS from the "tostring(duration, "duration") output? I don't need either field. Thanks everyone!

0 Karma


If a transaction represents a "session", then the following will give you the average across all sessions. Each session has its own duration, as you described it above. The average function will do what you want,

| transaction username startswith=eval(active) endswith=eval(inactive) 
| stats avg(duration) as avgDuration
| eval avgDuration = tostring(avgDuration,"duration")

avgDuration is expressed in seconds. If you don't want the hours and seconds, you could do this to get only the minutes:

| eval avgDuration = round(avgDuration/60,0)

One way to verify this for yourself is to look at the intermediate results. For example:

| transaction username startswith=eval(active) endswith=eval(inactive) 
| table username duration

will show you the intermediate data that is passed to the stats command.


Thank you! This was very helpful. I confirmed that the duration is for each transaction within the given time period by tabling the duration of my query, then doing the avg(duration) after confirming the question I had. Here is the query I came up with which has a very nice format for simple human consumption.

eventtype=mobile action="App_Active" OR action="App_Inactive" | transaction user_email startswith=eval(action="App_Active") endswith=eval(action="App_Inactive") | stats avg(duration) as seconds | sec2time(seconds,time_spent) | fields time_spent | eval shortened = substr(time_spent,10,16) | table shortened

I used a cool macro that someone out there created called "sec2time" then used substring to remove day and hour (since duration will always be at the most in minutes)

Result in panel: 4m 13s

Thank you again for the help!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...