Hi,
I have a parameter system_mem
that records the memory usage of an application.
I am trying to do analysis by using transactions and see each session, for the previous 100 events or so, leading up to the max memory usage.
Is it possible to have something like the search below? Currently, my transactions do not end with the maximum system_mem
experienced by the user. Why is this?
index=iis earliest=-7d@d latest=@d | eval c_time=_time | eval c_time=strftime(_time,"%Y-%m-%d %H:%M:%S") | transaction GUID maxpause=60min endswith=(eventstats=max(system_mem)) mvlist=t keepevicted=true | table GUID c_time cs_uri_stem system_mem
To note I do not have a sessionId, only a unique user ID.
Thanks,
Dan
Please try this.
index=iis earliest=-7d@d latest=@d | eval c_time=_time | eval c_time=strftime(_time,"%Y-%m-%d %H:%M:%S") | eventstats max(system_mem) as max_mem, min(system_mem) as min_mem by GUID | search system_mem=max_mem OR system_mem=min_mem | fields - max_mem, min_mem | transaction GUID mvlist=t keepevicted=true | table GUID c_time cs_uri_stem system_mem
Hope it helps you.
If I understand you correctly and we are assuming that a "session" can be inferred by an increase of memory usage (e.g. so long as memory is increasing, it is the same session; whenever it decreases, a new session has begun), then we can manufacture a sessionID using streamstats
like this:
index=iis earliest=-7d@d latest=@d | eval c_time=_time | eval c_time=strftime(_time,"%Y-%m-%d %H:%M:%S") | reverse | streamstats current=f last(system_mem) AS prev_system_mem BY GUID | eval new_session=if((system_mem<prev_system_mem),"TRUE",null()) | streamstats current=t count(new_session) AS sessionID BY GUID
Now each GUID's event has a sessionID
field that can be used to distinguish/group events that can be exploited by tacking on something like | stats blah blah blah BY GUID sessionID
.
Any time that you can avoid transaction
, you should; it is very slow/costly to use it.