topic Re: Not result get from collect in Knowledge Management

Not result get from collect

Wendy1990 — Tue, 29 Sep 2020 06:38:02 GMT

I schedule below search, search name is "TransactionResult"

sourcetype="ims*" host="chi*" ActivityId!="(null)" (Action="Start" OR Action="End") | eval TopicName= mvindex(split(TopicName,"."),-1) | transaction ActivityId TopicName startswith="Start" endswith="End" maxevents=2 | fields FirmName ActivityId TopicName duration _time | collect addtime=true index=summary_abuse

After above search completed, I use

"index=summary_abuse search_name="TransactionResult" to get the result of search , but the result is empty ,why?

Re: Not result get from collect

alacercogitatus — Wed, 08 Jul 2015 21:57:10 GMT

I don't think search_name is the right field to use here.

Did you try:

index=summary_abuse source="TransactionResult"

Re: Not result get from collect

masonmorales — Wed, 08 Jul 2015 23:02:09 GMT

Best practice is to use a marker, which creates a new key/value pair in each SI result. The marker then allows you to easily retrieve the results you want from the SI.

Here's how you can add it to your search:

sourcetype="ims*" host="chi*" ActivityId!="(null)" (Action="Start" OR Action="End") | eval TopicName= mvindex(split(TopicName,"."),-1) | transaction ActivityId TopicName startswith="Start" endswith="End" maxevents=2 | fields FirmName ActivityId TopicName duration _time | collect addtime=true index=summary_abuse marker="si_search_name=TransactionResult"

Then, to retrieve the results, you just do:

index=summary_abuse si_search_name=TransactionResult

Re: Not result get from collect

Wendy1990 — Thu, 09 Jul 2015 14:15:33 GMT

Transaction can calculate duration, but I don't see the field duration value for each ActivityId.

Re: Not result get from collect

Wendy1990 — Thu, 09 Jul 2015 14:24:35 GMT

I want to save the result of transaction command, now I can see the event with your command, but duration value is null, why?
I use this command
index=summary source="transtest" | table FirmName ActivityId TopicName duration _time