Why is the Splunk Web service not running after an upgrade to 6.2? Learn more »
Is there some kind of wierdness with mulit-value transaction fields where you can't run operatoins on them?
For example, if I put the eval before the tranaction, it ends up in the table, but if I put it after(second example), no dice. And since the delta sits downstream of the transaction, it's not getting anything as you can see by the empty TimeWait column with spider webs and tumbweeds in it
index=* sourcetype="oraclehotobject4" OraInst=2| eval OTime= tonumber(OraTimeWaited) | transaction OraObjID OraEvent keepevicted=true mvlist=true | delta(OTime as TimeWaited) p=1 | table OraTimeStamp OraObjID OraEvent OraObjName OraTimeWaited OTime TimeWaited duration
sourcetype="oraclehotobject4" OraInst=2 | transaction OraObjID OraEvent keepevicted=true mvlist=true | eval OTime= tonumber(OraTimeWaited)| delta(OTime as TimeWaited) p=1 | table OraTimeStamp OraObjID OraEvent OraObjName OraTimeWaited OTime TimeWaited duration
This ONLY happens with the mulit-line/event transactions as you see below. is the missing OTime (I had to cast that to a number). So it seems like OraTimeWaited is not making it out of the multi-event transaction, so, I can't do a delta on them.
If I use anything other then mvlist=true, I don't get proper transactions.
OraTimeStamp ObID Event Object OraTimeWaited OTime TimeWaited Duration
12-30-2011 01:37 119525 sequential read ERRORS_N1 9635 9635 0
12-30-2011 01:37 123669 db file write ERRORS_N1 9635 240 12-30-2011 01:41 123669 db file write ERRORS_N1 9635
Transaction grouping 1 Answer
Finding mismatched events 2 Answers