CODEWITHSUNDEEP
splunk
Paddy
Paddy

Reputation: 583

Splunk - Merging Associated Events

I have a script which sends individual events into Splunk, each event is essentially a report on a HTTP Request, either GET or POST. The event contains a number of fields but two key ones are StepName and Timing:

  1. StepName will be a title for the HTTPRequest etc. PostLogin
  2. Timing will be a int value of the milliseconds taken by HttpRequest

I'm writing a report which shows the average time taken for each step over last 15 minutes. However, from an end users point of view, some steps are part of one process e.g.

  1. Step1 - GetLoginPage
  2. Step2 - PostLoginPage
  3. Step3 - ProcessUserDetails
  4. Step4 - GetHomePage

In this case Step2 and Step3 would be one process for an end user, therefore I'd like to be able to report on these as if they were one step so the following:

GetLoginPage 50
PostLoginPage 100
ProcessUserDetails 250
GetHomePage 80

would become

GetLoginPage 50
PostLoginPage 350
GetHomePage 80

I can use a replace on the StepName so I have

GetLoginPage 50
PostLoginPage 100
PostLoginPage 250
GetHomePage 80

How can I then merge these results so it summates the two PostLoginPage steps and then gives me an average over the time period for the three individual steps?

Note each step has a field called TransactionGUID which associates a group of steps for the same execution.

Upvotes: 1

Views: 329

Answers (1)

Damien Dallimore
Damien Dallimore

Reputation: 204

If you post your question over at http://splunk-base.splunk.com/answers/ , you'll have access to a greater audience of Splunk expertise , and I will attempt to answer your question there.

Upvotes: 1

Related Questions