Splunk Search

Transactions that span time period are counted in stats in all time periods from start to end


I need stats on transactions (WAN outages) over a given period - 1 day, for instance - to be grouped by hour.

However, if a transaction starts in one hour and ends in the next or subsequent hours, it is counted in stats in each of the hours from start to end. It should be counted only once for the whole duration:

...|transaction host startswith="is down" endswith="is up"|stats count(duration) as "Count by hour" BY date _ hour | sort by date _ hour

I guess I need to count only start or end of each transaction, but can this be done in the same search, or is there yet a better way to achieve this?


Tags (1)

Splunk Employee
Splunk Employee
 ... | bucket _time span=1h | stats count by _time

Don't use the date_* fields, use _time.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!