Splunk Search

transaction duration between subevents

Splunk Employee
Splunk Employee

Is it possible to calculate all the duration between subevents in a transaction? For example..

Here's the search:

index=citrix source="C:\Temp\tslogon_log.txt" | transaction UserName host startswith="STARTED" endswith="FINISH"

...and output
alt text

We would like to calculate the time difference between all steps in the transaction. So between Started and Step1Complete, then Step1Complete and Step2_Complete etc.. which all those differences should add to the 2.39 seconds Splunk calculated for the overall transaction. Any ideas?


0 Karma


I am not sure that you need the transaction command. The following

index=citrix source="C:\Temp\tslogon_log.txt"
| sort  UserName host _time
| delta _time as StepTime p=1
| eval Step=case(searchmatch("STARTED"),null(),

will create two new fields StepTime and Step, which can be used in a variety of ways

| stats avg(StepTime) as AverageStepTime by Step


| stats avg(StepTime) as StepTime by User Host Step

This solution requires that every "transaction" must have all of the components. It is okay if a transaction is in progress, as it will only calculate the completed steps. However, if the START is not logged or a step is not logged, then it may not work properly.

Ultra Champion

Hmm, you cant use _time after the transaction, so you must make an eval before the transaction, in order to preserve the timestamp for each subevent in a multivalued field.

...| eval sub_time = _time |

0 Karma