topic Transaction in Splunk Search

Transaction

rmathur3 — Wed, 30 Sep 2020 00:34:10 GMT

how can i define a transaction end based an extracted value? the value of terminal during the transaction start should be same as transaction end. 43699 in below case
for example :
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:37] Port Msg In: Port# 18, String B1, Length 2
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B20 CBA_3DES, Length 254
[21:43:40] Port Msg In: Port# 18, String
¯!SÈ, Length 5
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:44] Port Msg In: Port# 18, String A00CBA_3DES , Length 19
[21:43:44] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:45] 120234187Push Sale 43699 Sale ID 11903, RawItems 6162, RawItems 18
[21:43:45] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:45] Create PCEFTPOS thread and send Msg, Terminal:43701
[21:43:45] W_SBuffer 43699 | 0 0 0 | 11903 1 1
[21:43:45] 120234296Send sale delete 43699 Sale ID 11903, Items 18
[21:43:45] W_Sales 43699 11903 | 24
[21:43:45] 120234531 Cleared sale buffer, Terminal 43699
[21:43:46] Sale:11903 Time:21:43,2019-05-11 Terminal:43699 Clerk:32681 ($23.00)

Re: Transaction

adonio — Wed, 15 May 2019 12:21:59 GMT

what is the desired output / outcome of the search?
what is it that you are after?

Re: Transaction

jodyfsu — Wed, 15 May 2019 13:51:52 GMT

As long as the "terminal" is extracted and in each event it should work. But I do not see the "terminal" in the first line.
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19

I may be misunderstanding the issue.

Re: Transaction

betchim_gerwili — Wed, 15 May 2019 14:59:28 GMT

Would you be able to extract the field using the splunk field extractor? I've used that for several things and have usually had good results from it.

Re: Transaction

rmathur3 — Wed, 30 Sep 2020 00:34:44 GMT

From the whole big log, i want below to be treated as one transaction. i want to calculate the transaction duration against the terminal number
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:37] Port Msg In: Port# 18, String B1, Length 2
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B20 CBA_3DES, Length 254
[21:43:40] Port Msg In: Port# 18, String
¯!SÈ, Length 5
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:44] Port Msg In: Port# 18, String A00CBA_3DES , Length 19
[21:43:44] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:45] 120234187Push Sale 43699 Sale ID 11903, RawItems 6162, RawItems 18
[21:43:45] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:45] Create PCEFTPOS thread and send Msg, Terminal:43701
[21:43:45] W_SBuffer 43699 | 0 0 0 | 11903 1 1
[21:43:45] 120234296Send sale delete 43699 Sale ID 11903, Items 18
[21:43:45] W_Sales 43699 11903 | 24
[21:43:45] 120234531 Cleared sale buffer, Terminal 43699
[21:43:46] Sale:11903 Time:21:43,2019-05-11 Terminal:43699 Clerk:32681 ($23.00)

Re: Transaction

rmathur3 — Wed, 15 May 2019 17:27:37 GMT

thats right. so ideally the combination of first two lines should define the transaction start. and thelast line with same terminal number should be used as transaction end. after which i want to calculate the duration.