topic query to extract events with distict ids in Splunk Dev

query to extract events with distict ids

wye054 — Mon, 28 Sep 2020 15:38:56 GMT

i am trying to get all the request messages that passed through our application for a particular time frame . when i am searching using
sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error")

getting below events with repeatition of transaction ids . How to get distict tid instead of repeating tids ....
please help me on this , i am a newbea to this ...
Time Event 1 1/13/14
11:20:54.000 PM
Mon Jan 13 2014 23:20:54 tid(7677232): certificate validation succeeded
date_month = january host = dev source = /opt/store/off_device_logging/Leg.log.
sourcetype = Leg .log
2 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 tid(34223): Updating existing wsdl
date_month = january host = dev
source = /opt/store/off_device_logging/Leg .log sourcetype = Leg .log
3 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20 : tid(34223😞 wsdl Compilation Request
date_month = january host = dev source = /opt/store/off_device_logging/Leg .log
sourcetype = Leg .log
4 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 : tid(8006898): HTTP response code 200
date_month = january host = dev source = /opt/store/off_device_logging/Leg .log
sourcetype = Leg .log
5 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 tid(8006898): certificate validation succeeded
date_month = january host = dev
source = /opt/store/off_device_logging/Leg .log sourcetype = Leg .log

Re: query to extract events with distict ids

linu1988 — Tue, 14 Jan 2014 12:25:42 GMT

Hello,
I would assume all the events are different, so we can have the tid's first then you can have your calculations

sourcetype="*Leg  .log" tid |rex field=_raw "\stid\((?<TID>\d+)"|dedup TID|eval status = if(error == 200, "OK", "Error")

Give it a try. Thanks

Re: query to extract events with distict ids

somesoni2 — Tue, 14 Jan 2014 12:26:50 GMT

If the field tid or transactionId is already extracted use following

sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error") | dedup tid

If the tid field is not extracted, use following

sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error") | rex "\((?<tid>.*)\)" | dedup tid

you can save the regex to make it search time field extraction.