Splunk Search

How do you merge multi-threaded (non-consecutive) log entries into events?

kpattison
New Member

I have a multi-threaded application in Glassfish. A single event generates multiple lines of logging but multiple events can happen simultaneously causing logging to alternate between one event and another. Each event though will be on a distinct thread ID in the logs.

Is it possible to search for a string and have all the lines withing the min before and after that are on the same thread ID merged to be the one event?

Tags (3)
0 Karma

bgaignon
Path Finder

Not sure to understand but maybe transaction can help.

index=glassfish | transaction id_thread keepevicted=true

Transaction consume a lot of resources so reduce the time range.
Every events with the same id_thread will be concat to one.

0 Karma

kpattison
New Member

Can I assume that this is not possible in Splunk?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...