DEV Community

Maxime Guilbert
Maxime Guilbert

Posted on • Updated on

Splunk - Calculate duration between two events

If you are monitoring your application with Splunk, you can easily create some cool dashboards to see quickly what append. And, in some cases, you want to know how much a treatment took.

To do it, you have to do a transaction following the next model

[search] | transaction [common value between events] startswith="[key=value of a parameter of the first event]" endswith="[key=value of a parameter of the second event]" 
Enter fullscreen mode Exit fullscreen mode

Example

Alt Text

With this example, we want to check the duration between the log L1 and the log L4. And our common value is the id of the transaction.

So our search will look like :

[search] | transaction transactionId startswith="step=P1" endswith="step=P4" 
Enter fullscreen mode Exit fullscreen mode

Following the same process, you can check the duration between P1 and P3, P2 and P3 ...

Result

The result of this request will contain the two logs and a new field: duration.

Knowing that, you can :

  • display the value with the others
  • do some stats with
...| stats max(duration)

...| stats min(duration)

...| stats avg(duration)
Enter fullscreen mode Exit fullscreen mode
  • display it in a table
...| table duration
Enter fullscreen mode Exit fullscreen mode
  • use this request in a dashboard
  • ...

I hope it will help you!

Top comments (0)