topic Re: transaction group by two IDs in Splunk Search

transaction group by two IDs

fk319 — Thu, 07 Mar 2013 15:31:50 GMT

I have data that has two IDs for each transaction. Of course most logs have one or the other and only one has both. I tried:

...| transaction ID, ID2 |...

but found that I would sometimes get two transaction records, one with just ID and the other with both ID and IDs.

I could not find an "OR" option, just that the engine would figure it out. Does anyone have some suggestions?

Re: transaction group by two IDs

cramasta — Thu, 07 Mar 2013 19:45:48 GMT

would you say your data set is like this

event=1 host=a
event=2 host=a cookie=b
event=3 cookie=b

Re: transaction group by two IDs

fk319 — Thu, 07 Mar 2013 19:56:53 GMT

no, more like
event=1 host=a
event=2 cookie=b
event=3 host=a cookie=b

Re: transaction group by two IDs

martin_mueller — Fri, 08 Mar 2013 09:19:26 GMT

How do the two IDs relate to each other? In other words, how should events be grouped into one transaction?

Re: transaction group by two IDs

fk319 — Fri, 08 Mar 2013 12:03:33 GMT

In this case, one ID is external activity and the other ID is internal activity. some where during the transaction there is an a correlation between the two.

Re: transaction group by two IDs

martin_mueller — Fri, 08 Mar 2013 12:05:06 GMT

So the following events all form one big transaction?

event1 id=1
event2 id=1 id2=a
event3 id2=a

Re: transaction group by two IDs

fk319 — Fri, 08 Mar 2013 12:12:52 GMT

those work fine, it seams when I have id1 and id2 defined, then id1 and id2 correlated.

Re: transaction group by two IDs

yannK — Sat, 09 Mar 2013 16:36:38 GMT

try to add the presence of the 2 fields as a condition before the transactions :

id=* AND id2=* | transaction id id2

Re: transaction group by two IDs

fk319 — Mon, 11 Mar 2013 11:16:08 GMT

Then I would not see the details of id or id2, just the link between the two.