topic Re: Inner search for database-fetched data in Splunk Search

Inner search for database-fetched data

biju3705 — Tue, 19 Dec 2017 20:39:11 GMT

I have fetching data to Splunk from a transaction tracker table. My scenario is as given below.

Here is the example of the table data I fetch:

From the above data I need to find the count of transactions with status="Failed" and do not have any "Success" status. From the above example, I should get the result as 1, since transaction Id 1000 was successful in later stages.

Could you please advise.

Re: Inner search for database-fetched data

kamlesh_vaghela — Wed, 20 Dec 2017 04:22:43 GMT

HI @biju3705,

Can you please try this?

YOUR_SEARCH
| stats values(STATUS) as STATUS by TID
| where STATUS!="Success" AND STATUS="Failed"

Thanks

Re: Inner search for database-fetched data

nikita_p — Wed, 20 Dec 2017 06:36:01 GMT

Hi,
Can you try this if it helps?

...| stats values(Transation status) AS 'Status' values(Insert date time) AS Time BY "Transaction Id" | where Status="Failed"