Hi Team,
We have a service in Splunk which calls 3 different APIs and do some business logic and responds back a Code(P, W, F). I have my events some what looks like below : interaction-id is the common field.
event1: myservice transaction begins
event2: myservice calls first-api
event3: myservice call to first-api is successful
event4: myservice calls second-api
event5: myservice calls to second-api is success
event6: myservice calls third-api
event7: myservice calls to third-api is success
event8: myservice is respond with result code 'W'
Now I need a table with these columns:
_time | interaction-id | is first-api successful ? | is second-api successful ? | is third-api successful? | FInal Code |
sometime | someinteractionId | Yes | yes | yes | W |
" | " | No | yes | yes | X |
Please help me with the query.
How about
...
| stats first(_time) as _time values(*) as * by interaction-id
r. Ismo
Thanks for the reply Soutamo.
I ran this query but it is showing every other event along with the main events I mentioned in my post.
The output table is loaded with all default fields along with manually extracted fields; but I need only the fields mentioned in the table.
Note: In my post, I mentioned only the needed events.