Splunk Search

Parsing events within a transaction

gwu
New Member

Here's my search string:

host=abc* source="/log...*" | rex "^[\d|-]+ [\d|:|,]+ (?P<Identifier>[\w\w|_]+)\s" | transaction Company startswith="HelloPhrase" endswith="GoodbyePhrase" | timechart useother=F avg(eval(duration/60)) by Identifier

Within the start/end events, I want to parse and then extract the max of a number that appears within another event and additional information provided there. I've tried to illustrate what I'm looking for...

StartEvent...

Event1 [Number 1, processing size 100]...

Event2...additional information

Event45 [Number 7, processing size 50]...

EndEvent

I want to know how long it takes to complete the task and what the max number is along with the processing size of that event. Any suggestions would be greatly appreciated.

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

Look at the automatic fields populated by the transaction :
- duration
- eventcount

see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

If you want to also distinguish all the values for the events, the individual fields will be turned into multivalue fields,
you can use the multivalue functions like mvcount()

see http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsemultivaluefields

0 Karma

kristian_kolb
Ultra Champion

Hmm some more information, incl sample events would probably be helpful.

For a transaction, the duration field is calculated automatically. Assuming that you extract "Number" as in your pseudo events, somthing like the following to replace the timechart part;

... | stats max(Number) first(duration) by _time

/K

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...