transaction alternative

jhnworks — Tue, 29 Sep 2020 20:14:04 GMT

Have data in the following format ;
1:26:[06/28/2018][08:00:00.149][6959][3868982128][s537565/r17][servername1][filename.cpp:27][ActionMessage::ProcessMessage][][][][][][][][][][][][][][][][** Received request.][servername2]
2:26:[06/28/2018][08:00:00.159][6959][3868982128][s537565/r17][servername1][filename.cpp:57][ActionMessage::ProcessMessage][global1][global2][][][][Millz][][][][][][][][][][** Status: Authorized. ][]

3:26:[06/28/2018][08:00:00.149][6959][4005350256][s537565/r17][servername1][filename.cpp:27][ActionMessage::ProcessMessage][][][][][][][][][][][][][][][][** Received request.][servername2]
4:26:[06/28/2018][08:00:00.159][6959][4005350256][s537565/r17][servername1][filename.cpp:57][ActionMessage::ProcessMessage][global1][global2][][][][Millz][][][][][][][][][][** Status: Authenticated. ][]

| transaction field5 host maxevents=5 startswith="** Received*" endswith="** Status*" | sort -duration| table field25, duration

Need the table as
** Status: Authorized. .010
** Status: Authenticated. .010

However it results as
** Received request.
** Status: Authorized. .010
** Received request.
** Status: Authenticated. .010

What's the best way to normalise this and also get table to only have the 'endswith' string ?

Re: transaction alternative

FrankVl — Sat, 30 Jun 2018 09:40:41 GMT

Try this:

| stats range(_time) as duration latest(field25) as field25 by field5
| table field25,duration

topic transaction alternative in Splunk Search

transaction alternative

Re: transaction alternative