I schedule below search, search name is "TransactionResult"
sourcetype="ims*" host="chi*" ActivityId!="(null)" (Action="Start" OR Action="End") | eval TopicName= mvindex(split(TopicName,"."),-1) | transaction ActivityId TopicName startswith="Start" endswith="End" maxevents=2 | fields FirmName ActivityId TopicName duration _time | collect addtime=true index=summary_abuse
After above search completed, I use
"index=summary_abuse search_name="TransactionResult" to get the result of search , but the result is empty ,why?
I don't think search_name
is the right field to use here.
Did you try:
index=summary_abuse source="TransactionResult"
Best practice is to use a marker, which creates a new key/value pair in each SI result. The marker then allows you to easily retrieve the results you want from the SI.
Here's how you can add it to your search:
sourcetype="ims*" host="chi*" ActivityId!="(null)" (Action="Start" OR Action="End") | eval TopicName= mvindex(split(TopicName,"."),-1) | transaction ActivityId TopicName startswith="Start" endswith="End" maxevents=2 | fields FirmName ActivityId TopicName duration _time | collect addtime=true index=summary_abuse marker="si_search_name=TransactionResult"
Then, to retrieve the results, you just do:
index=summary_abuse si_search_name=TransactionResult
I don't think search_name
is the right field to use here.
Did you try:
index=summary_abuse source="TransactionResult"
Transaction can calculate duration, but I don't see the field duration value for each ActivityId.
I want to save the result of transaction command, now I can see the event with your command, but duration value is null, why?
I use this command
index=summary source="transtest" | table FirmName ActivityId TopicName duration _time