Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to record/calculate the duration of overlapping transactions

$
0
0
I have a transaction overlap issue. The output below is my data from search query with a transaction command. Here is my search query: **Search** index=* (sourcetype=InCharge-Traps AND (State="Notify" OR State="Clear")) OR (sourcetype=SAM_Audit AND (eventtype="Notification Notify" OR eventtype="Notification Clear")) source!="D:\\InCharge\\SAM\\smarts\\local\\logs\\TRAP-INCHARGE-OI_en_US_UTF-8.log" [| inputlookup New_SLA_Targets where Alert="y" | fields InstanceName EventName] | lookup New_SLA_Targets InstanceName EventName OUTPUT Service Target Type Dev_Needed Status Weight SecsDown StartTime EndTime | sort _time | transaction Service InstanceName EventName Type startswith=(State="Notify" OR eventtype="Notification Notify") endswith=(State="Clear" OR eventtype="Notification Clear") | concurrency duration=duration | eval stime=strftime(_time, "%H:%M:%S") | eval stime_epoch=_time | eval etime_epoch=stime_epoch+duration | eval etime=strftime(etime_epoch, "%H:%M:%S") | where stime>StartTime AND etimeSecsDown,"Y","N")) | where Active="Y" | table _time stime_epoch stime etime_epoch etime duration concurrency InstanceName EventName **Output** _time stime_epoch stime etime_epoch etime duration concurrency InstanceName EventName 2017-08-28 10:13:19 1503933199 10:13:19 1503933383 10:16:23 184 1 ualbuacwas5 Down 2017-08-28 10:17:15 1503933435 10:17:15 1503941278 12:27:58 7843 1 ualbuacwas4 Down 2017-08-28 12:22:35 1503940955 12:22:35 1503941180 12:26:20 225 2 ualbuacwas5 Down 2017-08-28 12:29:39 1503941379 12:29:39 1503945457 13:37:37 4078 1 ualbuacwas4 Down 2017-08-28 13:13:43 1503944023 13:13:43 1503947722 14:15:22 3699 2 ualbuacwas5 Down I need to identify and report the overlapping transactions and the overlapping duration. All other duration's are not important. So, if you look at the output stime_epoch 1503933435, the end of that transaction overlaps the next at stime_epoch 1503940955. This is the record with the concurrency of 2. I have two overlaps in my data and need to report on the duration of just the overlap. I believe in my example above, it would be 323 seconds. My second would be 1434. At this point I am stuck. I'm sure that someone out there can help me out. Thanks in advance, Rcp

Viewing all articles
Browse latest Browse all 47296

Trending Articles