Splunk Search

Parsing events within a transaction

gwu
New Member

Here's my search string:

host=abc* source="/log...*" | rex "^[\d|-]+ [\d|:|,]+ (?P<Identifier>[\w\w|_]+)\s" | transaction Company startswith="HelloPhrase" endswith="GoodbyePhrase" | timechart useother=F avg(eval(duration/60)) by Identifier

Within the start/end events, I want to parse and then extract the max of a number that appears within another event and additional information provided there. I've tried to illustrate what I'm looking for...

StartEvent...

Event1 [Number 1, processing size 100]...

Event2...additional information

Event45 [Number 7, processing size 50]...

EndEvent

I want to know how long it takes to complete the task and what the max number is along with the processing size of that event. Any suggestions would be greatly appreciated.

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

Look at the automatic fields populated by the transaction :
- duration
- eventcount

see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

If you want to also distinguish all the values for the events, the individual fields will be turned into multivalue fields,
you can use the multivalue functions like mvcount()

see http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsemultivaluefields

0 Karma

kristian_kolb
Ultra Champion

Hmm some more information, incl sample events would probably be helpful.

For a transaction, the duration field is calculated automatically. Assuming that you extract "Number" as in your pseudo events, somthing like the following to replace the timechart part;

... | stats max(Number) first(duration) by _time

/K

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...