|
Is there some kind of wierdness with mulit-value transaction fields where you can't run operatoins on them? For example, if I put the eval before the tranaction, it ends up in the table, but if I put it after(second example), no dice. And since the delta sits downstream of the transaction, it's not getting anything as you can see by the empty TimeWait column with spider webs and tumbweeds in it index=* sourcetype="oraclehotobject4" OraInst=2| eval OTime= tonumber(OraTimeWaited) | transaction OraObjID OraEvent keepevicted=true mvlist=true | delta(OTime as TimeWaited) p=1 | table OraTimeStamp OraObjID OraEvent OraObjName OraTimeWaited OTime TimeWaited duration sourcetype="oraclehotobject4" OraInst=2 | transaction OraObjID OraEvent keepevicted=true mvlist=true | eval OTime= tonumber(OraTimeWaited)| delta(OTime as TimeWaited) p=1 | table OraTimeStamp OraObjID OraEvent OraObjName OraTimeWaited OTime TimeWaited duration This ONLY happens with the mulit-line/event transactions as you see below. <xxx> is the missing OTime (I had to cast that to a number). So it seems like OraTimeWaited is not making it out of the multi-event transaction, so, I can't do a delta on them. If I use anything other then mvlist=true, I don't get proper transactions. OraTimeStamp ObID Event Object OraTimeWaited OTime TimeWaited Duration 12-30-2011 01:37 123669 db file write ERRORS_N1 9635 <xxx> <spiderweb> 240
12-30-2011 01:41 123669 db file write ERRORS_N1 9635 <xxx> <tumbleweed> Thanks! |