- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How can I find the reoccurring group of transactio...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I find the reoccurring group of transactions over time?
Hey Folks,
I have a transaction search that "groups" various things of interest (5m maxspan etc ). I was wondering - how could I count the reoccurrences of transaction groups over time? Some sort of eval I guess but ain't sure....
thx,
R
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@RocIngersol - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using transaction causes many metadata fields to be created including eventcount which is exactly what you need. Once the search completes, in the events area, to the left aligned with the the first line of each transaction, in the i column, you should see a > character. Click on this and it will become a v character. Then scroll down to the bottom of your event to see a wonderful land of insight showing each field/value that exists for this event, even the uninteresting ones.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you give a specific example of what you would call a recurrence? That description or example is going to determine how you need to treat the data in order to be able to find that recurrence.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure, thx. So my transaction search runs and I get lots of "grouped events" by my criteria and max span etc. So while that's valuable I want to count the occurrences of each transaction group over time. I tried building a new field after transaction with eval newIDfield=field1+field2 But that results in some newIDfield being blank when there are multiple different values for field1 out of the transaction..
Hope that is clearer! I'll post my search when I'm online later if not.
R
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The search itself would help. The main question is, how do you (as a data consumer) know that a later transaction is a recurrence of an earlier one, as opposed to a closely similar but different transaction?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You probably need timechart, maybe ... | timechart count BY host added to your existing search.
Splunk Custom Visualizations App End of Life
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
