Splunk Search

Transaction with uri and referer in apache access

geoff1
New Member

Hi,
I have a Apache access log,for events in every transaction,the referer field of the second event will be the same as uri of the first event, which looks like this:

clientip [timestamp] - - - GET uri1 ... referer1 ...

clientip [timestamp] - - - GET uri2 ... referer2=uri1 ...

clientip [timestamp] - - - GET uri3 ... referer3=uri2 ...

Can I make a transaction based on clientip, uri, referer?

Thanks,
Geoff

0 Karma

kristian_kolb
Ultra Champion

transaction does not work quite that way. The point of specifying more than one field to base the transaction on, is to allow it to span across different types of log, e.g.

  • logs from system_1 contains fieldA=xxx fieldB=yyy
  • logs from system_2 contains fieldB=yyy fieldC=zzz
  • logs from system_3 contains fieldC=zzz fieldD=qqq

Then you can link it together with transaction fieldB fieldC.

In your case you only have a single source of events, but the values on which you want to build your transaction moves between fields. It would be infinitely easier to use a session-id or similar.

/K

0 Karma

geoff1
New Member

Thanks Kolb. Yes I know if the events are in different sourcetypes, it could be eazier to correlate them. But I don't have a session-id in the access log now. Any other commands can get a similiar result as I want?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...