Determining concurrency
Determining the number of users currently using a system is difficult, particularly if the log does not contain events for both the beginning and end of a transaction. With web server logs in particular, it is not quite possible to know when a user has left a site. Let's investigate a couple of strategies for answering this question.
Using transaction with concurrency
If the question you are trying to answer is "how many transactions were happening at a time?", you can use transaction to combine related events and calculate the duration of each transaction. We will then use the concurrency command to increase a counter when the events start, and decrease when the time has expired for each transaction. Let's start with our ...
Get Implementing Splunk: Big Data Reporting and Development for Operational Intelligence now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
