Splunk Search
Highlighted

Transaction time

New Member

Query used:

index=[server]| transaction Extract startswith="Value Extract Starting." endswith="extraction completed."

Log Result:

1 » 10/4/13 11:39:58.000 PM

2013-10-04T19:39:58 Extract STATUS Value Extract Starting.

2013-10-04T19:40:02 Extract STATUS extraction completed.

2 » 10/4/13 11:10:15.000 PM

2013-10-04T19:10:15 Extract STATUS Value Extract Starting.

2013-10-04T19:10:21 Extract STATUS extraction completed.

Need to find the time difference in a transaction for start and end line. Time is present in both the lines.
Eg: From the first event i should get time differnce from 2013-10-04T19:39:58 and 2013-10-04T19:40:02 and should plot it as x-axis day and y-axis time difference.

Tags (2)
0 Karma
Highlighted

Re: Transaction time

Legend

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

"The transaction command produces two fields, duration and eventcount. The duration value is the difference between the timestamps for the first and last events in the transaction. The eventcount value is the number of events in the transaction."