Splunk Search

How to display time parameters (start time, end time, total duration) of a transaction?

hemanath_ofc
Explorer

10/21/14 13:17:08.747 SERIAL ZPIMXTerminal.Send Start
10/21/14 13:17:08.747 SERIAL SerialComClass:**NOTICE: Serial Port cleared OK
10/21/14 13:17:08.809 **SERIAL GetAckNak Sent
: [00]
10/21/14 13:17:08.840 WLL-EX CCTX_POS_GET_TenderTypeStatus = 0

10/21/14 13:17:08.919 SERIAL SerialComClass:****NOTICE: Serial Port cleared OK
10/21/14 13:17:08.919 SERIAL Send Msg() >
10/21/14 13:17:08.981 SERIAL GetAckNak Recv: [00]

10/21/14 13:17:09.090 WLL-EX CCTX_OS_GET_TypeStatus = 0

10/21/14 13:17:09.090 SERIAL SerialComClass:**NOTICE: Serial Port cleared OK
10/21/14 13:17:09.153 **SERIAL GetAckNak Recv
: [00]
10/21/14 13:17:09.262 SERIAL SerialComClass:****NOTICE: Serial Port cleared OK
10/21/14 13:17:08.747 SERIAL ZPIMXTerminal.Send Start

in above log.. i formed a transaction using "transaction startswith="ZPIMXTerminal.Send Start" endswith="ZPIMXTerminal.Send Start"

but I'm not sure how to display time parameters. I would like to see start time of transaction, end time of transaction and total duration. Along with that, I wanted to display the start and end time of "GetAckNak " in a table. Can anyone help?

0 Karma

vasanthmss
Motivator

transaction startswith="ZPIMXTerminal.Send Start" endswith="ZPIMXTerminal.Send Start"|eval starttime=_time|eval endtime=_time+duration

If you want to convert time to human readable format use this
|convert ctime(starttime) ctime(endtime)

V

hemanath_ofc
Explorer

Thanks Vasanth..

But can i find the duration of different event within a transaction.

for expample : time between
SERIAL GetAckNak Sent: [00]

SERIAL GetAckNak Recv: [00]

0 Karma

vasanthmss
Motivator

Add a transaction command next to earlier one based on your req.

V
0 Karma

vasanthmss
Motivator

Is it working?

V
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...