Getting Data In

Transaction start and finish times

Ant1D
Motivator

Hey,

I have a question about the transaction search command.

If I am using a transaction on an event that has two timestamps in it, how can I access/use both of the timestamps after the transaction is done for start and finish times?

Here's an example of one event that has two timestamps in it.

1342541754952 environment="prodemea" event_type="JobStarting" component="Job Controller" job_id="cf430a0b-bfcd-4765-891d-253da3607135"
1342541758729 environment="prodemea" event_type="JobCompleted" component="Job Controller" job_id="cf430a0b-bfcd-4765-891d-253da3607135"

Here's the search that I am doing:
index=prod (event_type="jobStarting" OR event_type="JobCompleted") | transaction job_id | table _time duration job_id

The result of the search gives me the start time (_time), the duration of the transaction and the job_id. How can I also get the finish time? (which in this case would be 1342541758729)

Thanks in advance for your help.

1 Solution

Ayn
Legend

_time is an epoch value, so to get the end time you can just add duration to the transaction event's timestamp.

... | eval starttime=_time | eval endtime=_time+duration

View solution in original post

Ayn
Legend

_time is an epoch value, so to get the end time you can just add duration to the transaction event's timestamp.

... | eval starttime=_time | eval endtime=_time+duration

Ant1D
Motivator

seems to do the trick. wasn't sure at first that this would work because the duration values didn't seem to be in a format that could be added to the start time. Thanks.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...