I am a beginner in Splunk.
I have a log file with events related to the creation of some products, identified by ID1, ID2, ..., as in the sample below:
2014-08-27T09:44:33 created product with ID1
2014-08-27T09:44:34 Product ID1 handed off to Subsystem
2014-08-27T09:44:35 polling Subsystem for ID1
2014-08-27T09:44:36 created product with ID2
2014-08-27T09:44:37 polling Subsystem for ID1
2014-08-27T09:44:38 ID1 status - waiting
2014-08-27T09:44:38 Product ID2 handed off to Subsystem
2014-08-27T09:44:39 polling Subsystem for ID2
2014-08-27T09:44:40 ID2 status - waiting
2014-08-27T09:44:41 polling Subsystem for ID1
2014-08-27T09:44:42 polling Subsystem for ID2
2014-08-27T09:44:43 ID2 status - waiting
2014-08-27T09:44:44 ID1 status – waiting
2014-08-27T09:44:45 polling Subsystem for ID1
2014-08-27T09:44:46 polling Subsystem for ID2
2014-08-27T09:44:47 ID1 status - completed
2014-08-27T09:44:48 ID2 status – waiting
2014-08-27T09:44:49 polling Subsystem for ID2
2014-08-27T09:44:50 ID2 status – waiting
2014-08-27T09:44:51 polling Subsystem for ID2
2014-08-27T09:44:52 ID2 status – completed
Is it possible to create a transaction that contains only the events related to the same product identifier (e.g. only the lines that contains ID1)?
I don't know how to isolate the events by product ID in a transaction.
Thank you for any idea.
use a field extraction to create a anew field that will contain ID1 or ID2 etc...
then use the transaction on this field.
example :
* | rex "(with|for|\d+) (?<_ID_>ID\d+)" | transaction _ID_
PS : I added the underscore around ID to avoid html formatting, you can remove them.
Thanks Yann!
use a field extraction to create a anew field that will contain ID1 or ID2 etc...
then use the transaction on this field.
example :
* | rex "(with|for|\d+) (?<_ID_>ID\d+)" | transaction _ID_
PS : I added the underscore around ID to avoid html formatting, you can remove them.