First and Last event of Transaction

Shashank_87 — Mon, 09 Mar 2020 12:43:05 GMT

Hi, I am working on a query where I need to join some events using a transaction command in Splunk. Below is my query where I am joining a particular web service request with a response using a "requestID" and then extracting the data. Now what happens is if the response contains an error, it will again try and may be next time it gets success. requestID remains same here.
Right now this query is just using the 1st response event which it encounters and reported as error even if it is not.

How do i extract the last of the responses so that i get the updated data whether it resulted in an error or success.

index=temp ("SoapMessage" "GetCustomerRequest") OR ("SoapMessage" "GetCustomerResponse")
| rex field=_raw ">(?[^<]+)<\/\w+?:requestID>"
| transaction requestID startswith="GetCustomerRequest" endswith="GetCustomerResponse" keepevicted=true
| search eventcount > 1

Re: First and Last event of Transaction

xavierashe — Mon, 09 Mar 2020 14:48:45 GMT

try this:

 index=temp ("SoapMessage" "GetCustomerRequest") OR ("SoapMessage" "GetCustomerResponse")
| rex field=_raw "\>(?[^\<]+)\<\/\w+?\:requestID\>"
| transaction requestID startswith="GetCustomerRequest" endswith="GetCustomerResponse" keepevicted=true mvlist=true
| search eventcount > 1
| eval  last_response=mvindex(response, -1)

topic Re: First and Last event of Transaction in Splunk Search

First and Last event of Transaction

Re: First and Last event of Transaction