Splunk Search

Why does using bucket span before transaction command give wrong duration in results?

RohiniJindam
Path Finder
sourcetype = abc | bucket span=1h _time | transaction user_ip destination_domain maxspan=20s maxpause=2s | stats count  by duration destination_domain  

This search renders duration for all fields as "0"

sourcetype = abc | transaction user_ip destination_domain maxspan=20s maxpause=2s | stats count  by duration destination_domain  

Whereas the above search gives the correct duration between the events. Any thoughts where I am going wrong?

Thanks

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

the bucket command basically rounds down all _time values to the nearest hour. The transaction command then calculates duration using the _time values of the events. Since in your transactions the _time values will all be rounded to the same hour, they will all appear to occur at the exact same time. Hence the durations will all be zero.

Plus, given your search, there appears to be no legitimate reason to bucket _time... You're not using the _time values anywhere except implicitly in transaction, and the only thing it's doing in transaction is bad.

If your stats clause at the end was trying to group your transactions by duration, destination_domain, and the hour in which they occurred, then this search would make sense fwiw:

sourcetype = abc | transaction user_ip destination_domain maxspan=20s maxpause=2s | bucket span=1h _time | stats count by duration destination_domain _time

View solution in original post

sideview
SplunkTrust
SplunkTrust

the bucket command basically rounds down all _time values to the nearest hour. The transaction command then calculates duration using the _time values of the events. Since in your transactions the _time values will all be rounded to the same hour, they will all appear to occur at the exact same time. Hence the durations will all be zero.

Plus, given your search, there appears to be no legitimate reason to bucket _time... You're not using the _time values anywhere except implicitly in transaction, and the only thing it's doing in transaction is bad.

If your stats clause at the end was trying to group your transactions by duration, destination_domain, and the hour in which they occurred, then this search would make sense fwiw:

sourcetype = abc | transaction user_ip destination_domain maxspan=20s maxpause=2s | bucket span=1h _time | stats count by duration destination_domain _time

RohiniJindam
Path Finder

Thank you for your help.

0 Karma

sideview
SplunkTrust
SplunkTrust

You got it.

0 Karma

RohiniJindam
Path Finder

True that. I do need | stats count by duration destination_domain _time in the base search that's generating the summary rows.
So if i understand the following search correctly,

sourcetype = abc | transaction user_ip destination_domain maxspan=20s maxpause=2s | bucket span=1h _time | stats count by duration destination_domain _time

transaction command will render the _time values as those of the first event in the transaction. bucket will round off these values to the nearest hour, right?

0 Karma

sideview
SplunkTrust
SplunkTrust

OK. If that | stats count by duration destination_domain is in the search generating the summary rows, then it'll be throwing the _time values away though. If the stats is in a search against the summary events and you've just simplified the question down, that's kind of a different issue.

Either way though it sounds like you want a | stats count by duration destination_domain _time in the base search that's generating the summary rows.

RohiniJindam
Path Finder

Thankyou for your response, nick.

I understand now. The reason I am using bucket _time is that I am summary indexing my data. So I have searches aggregating and working on data from the past hour. These results are further used in the daily and weekly searches. So i need the _time values.

0 Karma

linu1988
Champion

What i checked, Bucket command is making it an interval of 1 hour to latest events to older ones. When you apply transaction it doesn't find the respective end to complete the transaction.

Get Updates on the Splunk Community!

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...