topic Re: Issue in transaction command in Splunk Search

Issue in transaction command

ramprakash — Thu, 22 Oct 2020 13:03:53 GMT

Hi Team,

I have few connections regarding transaction command. I have a series of events. One of the events are mentioned below.

1st event-RAUPPT_PT280916DC0101...sm_mr=PT280916DC0101

2nd event- LLAPTU_PT280916DC0101

Questions-

1. Here I want to use transaction command based on PT280916DC010 pattern. Can someone please provide me regex to extract this. PT* will be fixed for every event.

2. As PT280916DC0101 is used in multiple times on 1st event. Will it create any problems ?

Re: Issue in transaction command

to4kawa — Thu, 22 Oct 2020 13:25:36 GMT

1:
| rex "_(?<id>PT\d+[A-Z]{2}\d{4})"
2: no

sample:

index=_internal | head 1 | fields _time _raw | eval _raw="RAUPPT_PT280916DC0101...sm_mr=PT280916DC0101" | appendpipe [ eval _raw="LLAPTU_PT280916DC0101"] | rex "_(?<id>PT\d+[A-Z]{2}\d{4})"

Re: Issue in transaction command

ramprakash — Thu, 22 Oct 2020 13:43:34 GMT

@to4kawa I am unable to extract field PT280916DC0101 with | rex "_(?<id>PT\d+[A-Z]{2}\d{4})"

Re: Issue in transaction command

to4kawa — Thu, 22 Oct 2020 13:52:53 GMT

Is it necessary? if you don't extract it, transaction can be done.

Re: Issue in transaction command

ramprakash — Thu, 22 Oct 2020 13:59:13 GMT

@to4kawa ..Yes actually I want to perform some other operations on id once it is extracted runtime.

How can we extract it at run time ?

Re: Issue in transaction command

ramprakash — Thu, 22 Oct 2020 14:20:18 GMT

@to4kawa I am able to extract the field id with rex field= _raw "..."

But when I am running transaction command on id..there is no statistics coming except events

Re: Issue in transaction command

to4kawa — Thu, 22 Oct 2020 14:26:35 GMT

https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Transaction

transaction makes only duration and eventcount.

Re: Issue in transaction command

ramprakash — Thu, 22 Oct 2020 16:28:07 GMT

@to4kawa ...strangely it is not producing statistics but when I am using table =* at the end I could see the results.