Implementing Splunk 7, Third Edition - Third Edition

Using concurrency to estimate server load

In the previous example, the number of concurrent sessions was quite low since each transaction is counted as one event no matter how many events make up that transaction. While this provides an accurate picture of the number of concurrent transactions, it doesn't necessarily provide a clear picture of the server load.

Looking at the timeline of our events, we see a large spike of events at the beginning of our log. This did not affect the previous example, because most of these events belong to a single-user session.

Some web logs provide the time it took to serve a request. Our log does not have ...