Splunk Search

How to build a query to find the request and response of the main service and sub services

mprreddy51
Explorer

Hi,

I have a request and response logs for service.here is the question.
service A(main service)(id:1111):
---Internal service1(sub service)(id:1111)
---internal service 2(sub service)(id:1111)
----Internal service 3(sub service)(id:1111)
Here service A starts and creates a ID and it will execute sub services(1,2,3).Id Remains the same for main and sub services.
My requirement is:

I need to find out the time taken to complete the request and response for each and every main service. If the subservice failed then i should be able to see logs.In the events there is a success codes and failure codes.

please help with query.

0 Karma

guilmxm
SplunkTrust
SplunkTrust
0 Karma

mprreddy51
Explorer

I already did like this but not working:
Index=abc sourcetype=pqr service=moper |transaction id
but i am getting all events;

0 Karma

guilmxm
SplunkTrust
SplunkTrust

transaction is probably part of an answer, transaction will identify and group events depending on fields with values common to events, such as a session id. (which is your use)

But that's part of the job, you will next want to evaluate the response time per sub_service / id, it's hard to answer really without being in the data, but if you have field extracted, the sub service name and the id, some simple evaluation like (even without transaction)

| stats avg(myfield) by subservice_fieldname, id_fieldname

Should start putting you on the right way.

The stats command will automatically associate the id with sub_service if your fields are correctly extracted.
As said earlier, transaction will be useful to group events, its add valuable fields (look at the doc) you may need to use in your search before evaluating the response time for example.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...