Splunk Dev

query to extract events with distict ids

wye054
New Member

Hi

i am trying to get all the request messages that passed through our application for a particular time frame . when i am searching using
sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error")

getting below events with repeatition of transaction ids . How to get distict tid instead of repeating tids ....
please help me on this , i am a newbea to this ...
Time Event 1 1/13/14
11:20:54.000 PM
Mon Jan 13 2014 23:20:54 tid(7677232): certificate validation succeeded
date_month = january host = dev source = /opt/store/off_device_logging/Leg.log.
sourcetype = Leg .log
2 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 tid(34223): Updating existing wsdl
date_month = january host = dev
source = /opt/store/off_device_logging/Leg .log sourcetype = Leg .log
3 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20 : tid(34223😞 wsdl Compilation Request
date_month = january host = dev source = /opt/store/off_device_logging/Leg .log
sourcetype = Leg .log
4 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 : tid(8006898): HTTP response code 200
date_month = january host = dev source = /opt/store/off_device_logging/Leg .log
sourcetype = Leg .log
5 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 tid(8006898): certificate validation succeeded
date_month = january host = dev
source = /opt/store/off_device_logging/Leg .log sourcetype = Leg .log

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

If the field tid or transactionId is already extracted use following

sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error") | dedup tid

If the tid field is not extracted, use following

sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error") | rex "\((?<tid>.*)\)" | dedup tid

you can save the regex to make it search time field extraction.

0 Karma

linu1988
Champion

Hello,
I would assume all the events are different, so we can have the tid's first then you can have your calculations

sourcetype="*Leg  .log" tid |rex field=_raw "\stid\((?<TID>\d+)"|dedup TID|eval status = if(error == 200, "OK", "Error") 

Give it a try. Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...