Hi, I'm using splunk to provide some insights into our caching performance.
Across the entire set, I can easily do it by providing a constraint that will only match the cache hit/miss lines and extracting the "cacheresult" into the data model and graphing hits vs. misses.
That was easy. The harder part is how I do this for specific sets of transactions only.
i.e. I can do
sourcetype="gem" |transaction fields=request_id | search <transaction_type>
and this will give me only the transactions that match that transaction type
however, this can't be part of a constraint for data models, as data models can't have pipes, so I can't even build from there. Any idea on how to create a model from a subset of all transactions?
... View more