Dashboards & Visualizations

Search & count on value from line above

fwd4
Explorer

I'm looking create a table in Splunk which shows me a top 10 list of offending 'stores' which are creating 'duplicate' entries in our logs.

I can identify these duplicate entries by our response code 'V033', so I would like to search on this value but count on the store id which is several lines above. Is there a way to do this?

I have pasted an extract of a logfile below.

21/06/2011 12:12:12.685 Add store 7936424 to cache
.... (multiple lines, say 6 for example)
21/06/2011 12:12:13.083 Set response to V, V033 - Duplicate transaction

I'm a little new to Splunk so still feeling my way around. Thank you in advance.

1 Solution

dwaddle
SplunkTrust
SplunkTrust

One way to accomplish this is with the transaction command. Transaction pulls together related events into a larger event at search time. Transaction normally works best when you have a transaction id / session id / pid / thread name -- something common among the events to stitch them together.

http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

One way to accomplish this is with the transaction command. Transaction pulls together related events into a larger event at search time. Transaction normally works best when you have a transaction id / session id / pid / thread name -- something common among the events to stitch them together.

http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

0 Karma

fwd4
Explorer

Thank you, very interesting I'll give that a read. We have a process ID in the same logs which I could use to tie the transaction together (I removed it from my example above for simplicity).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...