基于Splunk构建仪表盘：筛选耗时超5秒的交易（transID、activity）

Got it, let's break down how to solve your two requirements using the log sample you shared.

1. Splunk Query to Find Transactions Taking Over 5 Seconds #

First, since your eventElapsedTime is logged in milliseconds, we'll use 5000 as our threshold (5 seconds = 5000 ms). Here's a practical query that pulls those slow transactions with useful context:

# Replace with your actual index and sourcetype values
index=your_target_index sourcetype=your_log_sourcetype
# Fallback field extraction (skip if Splunk auto-parses these fields already)
| rex field=_raw "eventElapsedTime=(?<eventElapsedTime>\d+)"
| rex field=_raw "transID=(?<transID>[^\|]+)"
| rex field=_raw "activity=(?<activity>[^\|]+)"
# Filter for transactions exceeding 5 seconds
| where eventElapsedTime > 5000
# Display key details in a clean table
| table transID activity eventElapsedTime STATUS eventStartTime eventEndTime

Quick Tips: #

• If Splunk already auto-extracted fields like eventElapsedTime and transID from your pipe-separated logs, you can remove the rex lines—they're just a backup for cases where auto-parsing fails.
• Swap your_target_index and your_log_sourcetype with the actual index/sourcetype where your logs are stored.

2. Dashboard to Show transID & activity for Slow Transactions #

Let's turn this query into a reusable dashboard panel:

• Run the query above (you can adjust the final line to | table transID activity if you only need those two fields).
• Click the Save As button (top-right of the search page) and select Dashboard Panel.
• Choose an existing dashboard or create a new one, then name your panel something clear like "Long-Running Transactions (>5 Seconds)".
• Pick Table as the visualization type—it’s perfect for displaying transaction IDs and activity details.
• Tweak formatting (like column widths) to your liking, then save the dashboard.

That’s all! You’ll now have a dedicated view showing every transaction that took longer than 5 seconds, with exactly the details you need.

内容的提问来源于stack exchange，提问作者Krishna