topic Re: How do you count the number of events in a transaction? in Getting Data In

How do you count the number of events in a transaction?

wissenaire17 — Sat, 17 Nov 2018 08:16:18 GMT

I need to count the number of particular events in a transaction. Here, I NEED to count the number of tickets that have failed:

[2018-11-16 16:59:45 0665 - Scanned barcode: EndOfTicketBarcode, 2705600009993 (Referrer=2705600009993, POSNumber=056, Checksum=3) 
2018-11-16 16:59:54 0003 - Send ticket failed 
2018-11-16 17:00:06 1833 - Send ticket failed 
2018-11-16 17:00:52 8165 - BLClient :: Connected to 84.10.32.2:8091],

Re: How do you count the number of events in a transaction?

acharlieh — Sun, 18 Nov 2018 15:46:20 GMT

There's multiple ways to interpret your request here.... the first being you're looking for the number of times you have an event of "Send ticket failed" which of course is rather simple

index=whatever sourcetype=yep "Send ticket failed" | stats count

However you mention transaction... which could mean that you're using the transaction command, which as the document says for each transaction that is assembled it leaves a field of eventcount

Re: How do you count the number of events in a transaction?

MathiasLindblom — Mon, 19 Nov 2018 14:45:37 GMT

As mentioned, there are multiple ways to interpret your question, this it my interpretation:
The original question is an example of the log and you want to see how many "Send ticket failed" it contains.
In the example below I use |rex command to extract the timestamp for each "Send ticket failed" (max_match unlimited). Then you can simply count the values in Fails:

<insert base search>
| rex field=_raw "(?P<Fails>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4})\s-\sSend ticket failed" max_match=0
| eval NrOfFails=mvcount(Fails)
| table _time Referrer Fails NrOfFails

Hope this helps if the answer from @acharlieh didn't work for you!

Re: How do you count the number of events in a transaction?

mstjohn_splunk — Tue, 20 Nov 2018 20:51:27 GMT

Hi @wissenaire17,

Did either of the answers below solve your problem? If so, please resolve this post by approving the one that helped you! If your problem is still not solved, keep us updated so that someone else can help. Thanks for posting!