Hi Glenn,
There are two approaches for getting the information joined together, using stats or transaction, assuming you can extract your "thing A" into a field called step :
sourcetype=process | stats values(step) as step values(_time) as times by id
sourcetype=process | eval time2=_time | transaction Xid id mvlist="step,time2"
If you can't extract a field, an alternative is to define eventtypes which you can use as a step description or numbering.
Subsequently we can start looking analysis, and one common use case is to look at flow paths or steps taken to determine if there are stuck IDs, and a neat way of doing so is to use mvcombine:
| mvcombine step | stats count by step
Additionally you want to compute step duration, which is hard to do in pure SPL, but can be achieved using a custom search script helper, like stepstats:
From the transaction example above | stepstats step,time2
which will compute the durations.
If you need the stepstats command, drop me an email on dart@splunk.com
Additionally, if you're looking to make different expected duration steps comparable, Apdex may be of interest.
... View more
