You could use a macro and update it over time as you add various known filters. That would simplify your search string. http://docs.splunk.com/Documentation/Splunk/5.0/Search/Usesearchmacros#Create_search_macros_in_Splunk_Web ... View more

I can't try it right now but it probably looks like this: <search> | stats count(IN) as inCount, count(OUT) as outCount, count(EXP) as expCount by SERVER | eval calcField = inCount - outCount - expCount | chart inCount, outCount, expCount, calcField by SERVER ... View more

Assuming you have the data coming into Splunk properly you'll first want to extract out the relevant fields. This wizard will help generate the required regular expression for you. That way you can now have a field called 'session'. http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/ExtractfieldsinteractivelywithIFX Then you can simply create a search that creates your transaction using session in this case, it could be a different value or multiple fields as well: search | transaction session This will automatically create larger transaction events and a duration field for the time. Given your needs above, once you get to this step we can create several searches to match the transactions by session or server name etc... If you don't have the data configured in Splunk yet you'll want to start here. It's pretty straightforward. http://docs.splunk.com/Documentation/Splunk/5.0/Data/Setupcustominputs ... View more

You could use a default date field and change it to 'stats count by date_mday'. (or date_wday which is week days versus month). http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Usedefaultfields The bucket command also gives you flexibility to manipulate blocks of data based on time. http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/bucket ... View more