I want to merge events that are in between state=" STARTED" and state="COMPLETED" i.e. All the following events of state="STARTED" and preceding to state="COMPLETED" will merge into a single event.
Hey
Do you have any field that may connect those events? Like an ID?
Then you could use transaction command with these parameters
endswith
Syntax: endswith=<filter-string>
Description: A search or eval expression which, if satisfied by an event, marks the end of a transaction.
startswith
Syntax: startswith=<filter-string>
Description: A search or eval filtering expression which if satisfied by an event marks the beginning of a new transaction.
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction
No Nothing to match.
Well and to you have events starting in between the others?
I mean:
event A started at X and ended at Y
event B starter at X+5 and ended at Y+3
Do you also have those scenarios?
There is the start time for each event, not the end time. And also not necessary that the event B start at X+5 .
So, In my case eventA gives me the log that Request1 started for user1
eventB gives me that Request2 has completed in time(* sec) for user2
And If there is any Error then another EventC is created in between A and B with Error log.
Now, I just want table "Error log" User.
Is this possible??
I don't see that possible if you don't have an element to trace the events back.
Can you show us a piece of your log with the events you mentioned?
Here's the code :
2018-02-09 18:10:25,542 INFO [qtp1687849576-8861]: "class name1" - [#0000e4ca] "Request1" from "ip_address1" ("email_id1") STARTED
2018-03-09 18:10:26,610 ERROR [qtp1687849576-12683]: "class name2" - Cannot retrieve. No UserLoginHistory information is stored.
2018-02-09 18:10:28,760 INFO [qtp1687849576-8861]: "class name1" - [#0000e4ca] "Request1" from "ip_address1"("email_id1") COMPLETED in 0.217s
Did you extract this "qtp1687849576" into field say abc and then
Can you try :
| transaction abc startswith="STARTED" endswith="COMPLETED"
Thanks @p_gurav
But can't rely on this "qtp..." thing.
Is there any other common field present in logs?