Advanced Search Examples - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 117

| concurrency duration=duration
| table _time concurrency duration eventcount
| sort _time
This produces a table as follows:
From these results, we can see that as transactions begin, concurrency increases
and then levels off as transactions expire. In our sample data, the highest value
of concurrency we see is 6 .
Using concurrency to estimate server load
In the previous example, the number of concurrent sessions was quite low, since
each transaction is counted as one event, no matter how many events make up that
transaction. While this provides an accurate picture of the number of concurrent
transactions, it doesn't necessarily provide a clear picture of server load.
Looking at the timeline of our events, we see a large spike of events at the beginning
of our log. This did not affect the previous example, because most of these events
belong to a single user session.