Dashboards & Visualizations

Search & count on value from line above

fwd4
Explorer

I'm looking create a table in Splunk which shows me a top 10 list of offending 'stores' which are creating 'duplicate' entries in our logs.

I can identify these duplicate entries by our response code 'V033', so I would like to search on this value but count on the store id which is several lines above. Is there a way to do this?

I have pasted an extract of a logfile below.

21/06/2011 12:12:12.685 Add store 7936424 to cache
.... (multiple lines, say 6 for example)
21/06/2011 12:12:13.083 Set response to V, V033 - Duplicate transaction

I'm a little new to Splunk so still feeling my way around. Thank you in advance.

1 Solution

dwaddle
SplunkTrust
SplunkTrust

One way to accomplish this is with the transaction command. Transaction pulls together related events into a larger event at search time. Transaction normally works best when you have a transaction id / session id / pid / thread name -- something common among the events to stitch them together.

http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

One way to accomplish this is with the transaction command. Transaction pulls together related events into a larger event at search time. Transaction normally works best when you have a transaction id / session id / pid / thread name -- something common among the events to stitch them together.

http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

0 Karma

fwd4
Explorer

Thank you, very interesting I'll give that a read. We have a process ID in the same logs which I could use to tie the transaction together (I removed it from my example above for simplicity).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...