Transaction by source, sourcetype, day

[sanjay_shrestha]

Following query has been used to calculate duration for individual source (input files) for last 5 days:

index="my_index" earliest=-5d  latest=now| transaction source maxevents=-1 | eval day=strftime(_time,"%m/%d/%Y")| sort - day sourcetype| table day,sourcetype,source,duration 

Only transaction by source is used, hoping it would capture all the input files which have unique file name, thus separating its sourcetype and date.

Basically, just need to display duration per individual source file per sourcetype per day.

Thanks,

Sanjay

[lguinn2 · Accepted solution]

There is a much more efficient way to do this:

index="my_index" earliest=-5d  latest=now
| eval day=strftime(_time,"%m/%d/%Y")
| stats range(_time) as duration by day sourcetype source
| eval duration=tostring(duration,"duration")

This is faster and more scalable.

[sanjay_shrestha]

Thanks. It worked better that using transaction.

[sanjay_shrestha]

It worked by adding keepevicted=true to transaction command.

[aholzer]

Now the above simply answers your question. I'm sure that there is a more efficient way of going about doing what you need, but I currently don't have time to work on it 😛

Hope the above helps.

[aholzer]

Because you have no limit to the number of events in your transaction, and because you have no start and end points for your transactions, and furthermore you have nothing limiting the transactions other than "source", then you are going to get 1 event (transaction) per source value you have.

You should calculate the day first, then use the day together with the source in your transaction. Like so:
index="my_index" earliest=-5d latest=now | eval day=strftime(_time,"%m/%d/%Y") | transaction source day maxevents=-1 | sort - day sourcetype| table day,sourcetype,source,duration