Splunk Search

Transaction time

New Member

Query used:

index=[server]| transaction Extract startswith="Value Extract Starting." endswith="extraction completed."

Log Result:

1 » 10/4/13 11:39:58.000 PM

2013-10-04T19:39:58 Extract STATUS Value Extract Starting.

2013-10-04T19:40:02 Extract STATUS extraction completed.

2 » 10/4/13 11:10:15.000 PM

2013-10-04T19:10:15 Extract STATUS Value Extract Starting.

2013-10-04T19:10:21 Extract STATUS extraction completed.

Need to find the time difference in a transaction for start and end line. Time is present in both the lines.
Eg: From the first event i should get time differnce from 2013-10-04T19:39:58 and 2013-10-04T19:40:02 and should plot it as x-axis day and y-axis time difference.

Tags (2)
0 Karma



"The transaction command produces two fields, duration and eventcount. The duration value is the difference between the timestamps for the first and last events in the transaction. The eventcount value is the number of events in the transaction."

Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...