https://community.splunk.com/t5/Knowledge-Management/How-to-group-input-and-output-request-log/m-p/382881#M5818 <P>We have our webservice logs on splunk having separate request (input) and response(output) log. There is one common unique id field between request and response log. But I want to match events in such a way to have count on basis of "requst_name" from request log and "response_cd" (where response_cd is not "00")from response log.</P> <P>Example of request and response events:</P> <P>REQUEST EVENT:</P> <P>TYPE=REQUEST,ID=ABCDEF,REQUST_NAME=API_LOGGING_INFO, DATE=YYYY-MM-DD,TIME=HH:MM:SS</P> <P>RESPONSE EVENT :</P> <P>TYPE=RESPOMSE, ID=ABCDEF,RESPONSE_CODE=00<BR /> (Response_cd may have different values)</P> <P>I have tried transaction commond to group events and then search for non "00" response-cd but search is taking very long time.</P> <P>Thanks in advance!</P> Tue, 29 Sep 2020 21:19:05 GMT MayankMathur198 2020-09-29T21:19:05Z https://community.splunk.com/t5/Knowledge-Management/How-to-group-input-and-output-request-log/m-p/382881#M5818 <P>We have our webservice logs on splunk having separate request (input) and response(output) log. There is one common unique id field between request and response log. But I want to match events in such a way to have count on basis of "requst_name" from request log and "response_cd" (where response_cd is not "00")from response log.</P> <P>Example of request and response events:</P> <P>REQUEST EVENT:</P> <P>TYPE=REQUEST,ID=ABCDEF,REQUST_NAME=API_LOGGING_INFO, DATE=YYYY-MM-DD,TIME=HH:MM:SS</P> <P>RESPONSE EVENT :</P> <P>TYPE=RESPOMSE, ID=ABCDEF,RESPONSE_CODE=00<BR /> (Response_cd may have different values)</P> <P>I have tried transaction commond to group events and then search for non "00" response-cd but search is taking very long time.</P> <P>Thanks in advance!</P> Tue, 29 Sep 2020 21:19:05 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-group-input-and-output-request-log/m-p/382881#M5818 MayankMathur198 2020-09-29T21:19:05Z https://community.splunk.com/t5/Knowledge-Management/How-to-group-input-and-output-request-log/m-p/382882#M5819 <P>As a starting point does the following help?</P> <PRE><CODE>( source=request OR source=response ) response_cd != 00 | stats count by id, source | stats count by id | where count &gt; 1 </CODE></PRE> Tue, 18 Sep 2018 18:36:05 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-group-input-and-output-request-log/m-p/382882#M5819 msivill_splunk 2018-09-18T18:36:05Z