Solved: Transaction to Find Duration - Page 3

skoelpin · ‎05-13-2015

I have a simple web service with a request and response called DeliverySchedule. The request and response have a unique identifier called a GUID which are in pairs. I'm trying to find the duration (response time) between the response and request.

Here's my search which is returning some correct durations but also listing 0 for more than 400 events . I'm also missing a lot of events

index=unleashed  "deliveryschedule"   | transaction GUID startswith="Request" endswith="Reply" | timechart avg(duration)

GUID = "33efb817-1948-4c8f-bdf4-4111aa1941cc" in this case. We will only have 2 matching GUID's which are attached to the req/resp. They will be different for each req/resp. I also did a field extraction called 'GUID' to capture the GUID between the pipes..

REQUEST

DEBUG 2015-05-13 15:31:40,590
 fterReceiveRequest - Request Record : |33efb817-1948-4c8f-bdf4-4111aa1941cc |
 &lt;GetDeliverySchedule xmlns="http://tempuri.org/"&gt;
  &lt;request&gt;
    &lt;DeliveryType /DotCom_Delivery"&gt;A&lt;/DeliveryType&gt;
    &lt;EndDate/DotCom_Delivery"&gt;2015-05-15&lt;/EndDate&gt;
    &lt;Region_StoreNo/DotCom_Delivery"&gt;970&lt;/Region_StoreNo&gt;
    &lt;Region_zip/DotCom_Delivery"&gt;11111&lt;/Region_zip&gt;
    &lt;StartDate/DotCom_Delivery"&gt;2015-05-13&lt;/StartDate&gt;
  &lt;/request&gt;
&lt;/GetDeliverySchedule&gt;

RESPONSE

DEBUG 2015-05-13 15:31:41,276        BeforeSendReply    - Response Record : |33efb817-1948-4c8f-bdf4-4111aa1941cc |
 &lt;GetDeliveryScheduleResponse xmlns="http://tempuri.org/"&gt;
  &lt;GetDeliveryScheduleResult xmlns:a="http://schemas.datacontract.org/2004/07/DotCom_Delivery" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"&gt;
    &lt;a:DeliveryCalendar&gt;
      &lt;a:Ranges&gt;
        &lt;a:DeliveryRange i:type="a:DeliveryDate"&gt;
          &lt;a:IsAvailableForDelivery&gt;false&lt;/a:IsAvailableForDelivery&gt;
          &lt;a:Date&gt;2015-05-13T00:00:00-04:00&lt;/a:Date&gt;
        &lt;/a:DeliveryRange&gt;
        &lt;a:DeliveryRange i:type="a:DeliveryDate"&gt;
          &lt;a:IsAvailableForDelivery&gt;false&lt;/a:IsAvailableForDelivery&gt;
          &lt;a:Date&gt;2015-05-14T00:00:00-04:00&lt;/a:Date&gt;
        &lt;/a:DeliveryRange&gt;
&lt;/a:Ranges&gt;
      &lt;a:TypeOfCalendar&gt;DayType&lt;/a:TypeOfCalendar&gt;
      &lt;a:ZoneId&gt;110&lt;/a:ZoneId&gt;
    &lt;/a:DeliveryCalendar&gt;
    &lt;a:StatusCode&gt;200&lt;/a:StatusCode&gt;
    &lt;a:StatusMessage&gt;OK&lt;/a:StatusMessage&gt;
  &lt;/GetDeliveryScheduleResult&gt;
&lt;/GetDeliveryScheduleResponse&gt;

woodcock · ‎05-13-2015

Transaction does a ton of things that you don't appear to need. Have you tried something like this:

index=unleashed  "deliveryschedule"  | stats earliest(_time) AS firstTime latest(_time) AS lastTime by GUID | eval duration=lastTime-firstTime | timechart avg(duration)

View solution in original post

Transaction to Find Duration

Introducing the 2024 SplunkTrust!

Introducing the 2024 Splunk MVPs!

Splunk Custom Visualizations App End of Life