Splunk Search

How to search all transactions existing in one payload and not present in another?

maxiva01
Engager

Hi,

Task: 2 different log files (source types). I want to find all transactions from first payload and check which of them are missed in second one. Then calculate amount and percentage of transaction that are exist in both log files
There is a common field in both log files, lest say fieldA

The solution I came up so far looks like below one

index=someIndex sourcetype=sourcetype1 SomeSearchCriteria
| join fieldA type=outer [search index=fsomeIndex sourcetype=sourcetype2 SomeSearchCriteria]
| fillnull value="NOVALUE" fieldA
| eval ResponseStatus=case(fieldA ="NOVALUE","noResponse", fieldA!="NOVALUE", "validResponse")
| bucket span=15m _time | stats count as Total count(fieldA) as NumberOfTransactions by ResponseStatus, _time
| eventstats sum(Total) as TOTAL_TRANSACTIONS
| eval PersentOfSuccessTransactions = round(100*NumberOfTransactions / TOTAL_TRANSACTIONS,2) 
| table PersentOfSuccessTransactions  NumberOfTransactions ResponseStatus _time

But in the response I see only "validResponse".
Is this something wrong with the query?

1 Solution

maxiva01
Engager

Finally I found out a solution that works great

 index=someIndex sourcetype=sourcetype1 SomeSearchCriteria
 | stats count as Total by fieldA
 | join type=left fieldA [search index=fsomeIndex sourcetype=sourcetype2 SomeSearchCriteria | stats count as Common by fieldA] 
| stats count(Total) as TransactionSent count(Common) as TransactionRecieved
| eval PersentDeliveredTransactions = round(100*TransactionRecieved / TransactionSent,2)
| table PersentDeliveredTransactions TransactionRecieved  TransactionSent

View solution in original post

0 Karma

maxiva01
Engager

Finally I found out a solution that works great

 index=someIndex sourcetype=sourcetype1 SomeSearchCriteria
 | stats count as Total by fieldA
 | join type=left fieldA [search index=fsomeIndex sourcetype=sourcetype2 SomeSearchCriteria | stats count as Common by fieldA] 
| stats count(Total) as TransactionSent count(Common) as TransactionRecieved
| eval PersentDeliveredTransactions = round(100*TransactionRecieved / TransactionSent,2)
| table PersentDeliveredTransactions TransactionRecieved  TransactionSent
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...