Splunk Search

query for transactions or grouping events

splunk_ier
Engager

Hi Team,

I have the below logs in splunk and i'm looking for query to get the time taken to compete the run by each bot for each scheduled run(Run bot deployed is the start of the bot and Run bot finished is the end of the bot).A bot can run more than once in a day and need average run time as well.I tried using transaction command but not getting desired results.

Thanks for the help

11/03/2021 22:22:20.600 STATUS=Successful,ACTIVITY AT=2021-03-11T22:22:19Z,ACTION TYPE=Run bot finished,ITEM NAME=fin_bot
11/03/2021 22:00:27.000 STATUS=Successful,ACTIVITY AT=2021-03-11T22:00:26Z,ACTION TYPE=Run bot Deployed,ITEM NAME=fin_bot
11/03/2021 15:20:04.400 STATUS=Successful,ACTIVITY AT=2021-03-11T15:20:04Z,ACTION TYPE=Run bot finished,ITEM NAME=fin_bot
11/03/2021 15:00:23.000 STATUS=Successful,ACTIVITY AT=2021-03-11T15:00:22Z,ACTION TYPE=Run bot Deployed,ITEM NAME=fin_bot
12/03/2021 04:02:15.800 STATUS=Successful,ACTIVITY AT=2021-03-12T04:02:14Z,ACTION TYPE=Run bot finished,ITEM NAME=tax_bot
12/03/2021 04:00:23.780 STATUS=Successful,ACTIVITY AT=2021-03-12T04:00:23Z,ACTION TYPE=Run bot Deployed,ITEM NAME=tax_bot

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @splunk_ier,

Use transaction command with satrtwith and endswith options like below:

index=INDEX sourcetype=sourcetype
| transaction startswith="Run bot Deployed" endswith="Run bot finished" 
| table _raw, duration, eventcount

For calculating average of duration extract field "ITEM NAME" if it does not exist and use stats.

index=INDEX sourcetype=sourcetype
| rex "ITEM NAME=(?<ITEM_NAME>[^,]+)$" 
| transaction startswith="Run bot Deployed" endswith="Run bot finished" 
| stats avg(duration) as avg_duration_sec by ITEM_NAME

 

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @splunk_ier,

Use transaction command with satrtwith and endswith options like below:

index=INDEX sourcetype=sourcetype
| transaction startswith="Run bot Deployed" endswith="Run bot finished" 
| table _raw, duration, eventcount

For calculating average of duration extract field "ITEM NAME" if it does not exist and use stats.

index=INDEX sourcetype=sourcetype
| rex "ITEM NAME=(?<ITEM_NAME>[^,]+)$" 
| transaction startswith="Run bot Deployed" endswith="Run bot finished" 
| stats avg(duration) as avg_duration_sec by ITEM_NAME

 

If this reply helps you, an upvote/like would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...