We have our webservice logs on splunk having separate request (input) and response(output) log. There is one common unique id field between request and response log. But I want to match events in such a way to have count on basis of "requst_name" from request log and "response_cd" (where response_cd is not "00")from response log.
Example of request and response events:
REQUEST EVENT:
TYPE=REQUEST,ID=ABCDEF,REQUST_NAME=API_LOGGING_INFO, DATE=YYYY-MM-DD,TIME=HH:MM:SS
RESPONSE EVENT :
TYPE=RESPOMSE, ID=ABCDEF,RESPONSE_CODE=00
(Response_cd may have different values)
I have tried transaction commond to group events and then search for non "00" response-cd but search is taking very long time.
Thanks in advance!
As a starting point does the following help?
( source=request OR source=response ) response_cd != 00
| stats count by id, source
| stats count by id
| where count > 1