Implementing Splunk 7, Third Edition - Third Edition

Using transaction with concurrency

If the question you are trying to answer is how many transactions were happening at a time, you can use transaction to combine related events and calculate the duration of each transaction. We will then use the concurrency command to increase a counter when the events start and decrease when the time for each transaction has expired. Let's start with our searches from the previous section:

sourcetype="impl_splunk_web" 
| transaction maxpause=5m uid 

This will return a transaction for every uid, assuming that if no requests were made for 5 minutes, the session is complete. This provides results as shown in the following screenshot:

By simply adding the concurrency command, we can determine the overlap of ...