#SPLUNK TRANSACTION EXAMPLE DOWNLOAD#

The information box automatically refreshes.

Select the next field in the list of Interesting Fields.

In the information box, for Selected, click Yes.

In the list of Interesting Fields, click the field name.

To see the values in each transaction for the JSESSIONID, clientip, concurrency, and duration fields:

The search also uses the eval command and the tostring() function to reformat the values of the duration field to a more readable format, HH:MM:SS.

The transactions are then piped into the concurrency command, which counts the number of events that occurred at the same time based on the timestamp and duration of the transaction.

The transaction command returns a field called duration.

An event is the last event of the transaction if the event contains the string 'purchase'. An event is the beginning of the transaction if the event contains the string 'view'.

This search groups events into transactions if they have the same values of JSESSIONID and clientip.

Sourcetype=access_* | transaction JSESSIONID clientip startswith='view' endswith='purchase' | concurrency duration=duration | eval duration=tostring(duration,'duration') Use the duration or span of a transaction to count the number of other transactions that occurred at the same time. Use the time range All time when you run the search.

#SPLUNK TRANSACTION EXAMPLE DOWNLOAD#

To try this example on your own Splunk instance, you must download the sample data and follow the instructions to get the tutorial data into Splunk. Count the transactions that occurred at the same time This example uses the sample data from the Search Tutorial. | concurrency duration=length start=et Extended examples 1. Use existing fields to specify the start time and durationĬalculate the number of concurrent events using the 'et' field as the start time and 'length' as the duration: | concurrency duration=total_time output=foo 3. Calculate the number of concurrent eventsĬalculate the number of concurrent events for each event and emit as field 'foo': Index=_internal sourcetype=splunkd_ui_access | eval spent_in_seconds = spent / 1000 | concurrency duration=spent_in_seconds 2. As always, you must be an 'admin' user, or have altered your roles scheme in order to access the _internal index. This relies on the fact that the timestamp of the logged message is the time that the request came in, and the 'spent' field is the number of milliseconds spent handling the request. Determine the number of overlapping HTTP requestsĭetermine the number of overlapping HTTP requests outstanding from browsers accessing splunkd at the time that each http request begins. This limit defaults to 10000000 or ten million.īasic examples 1. If the maximum tracked concurrency exceeds max_count, from the stanza in nf, a warning will be produced in the UI / search output, and the values will be clamped, making them potentially inaccurate. There is a limitation on quantity of overlapping items. |eval new_start = start - duration | concurrency start=new_start duration=duration Limits If your events have a time that represents event completion and a span that represents the time before the completion, you need to subtract duration from the start time before the concurrency command: See Command types.Īn event X is concurrent with event Y if X.start is between Y.start and (Y.start + Y.duration) The concurrency command is a dataset processing command. Default: _time output Syntax: output= Description: A field to write the resulting number of concurrent events. Optional arguments start Syntax: start= Description: A field that represents the start time. For example, the duration field generated by the transaction command is in seconds (see Example 1), which can be used with the default of _time which is also in units of seconds. This field must be a numeric with the same units as the start field. Required arguments duration Syntax: duration= Description: A field that represents a span of time. This command does not measure the total number of events that a particular event overlapped with during its total span. Alternatively, this measurement represents the total number of events in progress at the time that each particular event started, including the event itself. Concurrency measures the number of events which have spans that overlap with the start of each event.

Splunk transaction example