topic Search in transactions help in Splunk Search

Search in transactions help

cboillot — Thu, 08 Apr 2021 20:41:34 GMT

We have several log entries with what boils down to a transaction ID. I want to group these entries and within those groups, I want to create an alert that will trigger if a phrase shows up 10 or more times in 5 min. Below is what I currently have, but I don't think I am headed in the right direction.

index=index_name host=server_name sourcetype=moveit:fti*
| transaction tasknumer maxspan=300s
| search "could not get id"

Re: Search in transactions help

diogofgm — Fri, 09 Apr 2021 09:14:04 GMT

Is there a reason why you're using transaction? why not just look for the "could not get id" and simply do a stats count over the last 5 min?

index=index_name host=server_name sourcetype=moveit:fti* "could not get id" | stats count

If you can, post some more details regarding your raw data.

Re: Search in transactions help

cboillot — Fri, 09 Apr 2021 14:27:58 GMT

In the cause, each transaction would be a different job. Each job can have a have a few "could not get id" . so we need to know per job/transaction. We can have several jobs running at once.

Raw data has has date time, task number, and system message, in that order.

Re: Search in transactions help

cboillot — Fri, 09 Apr 2021 15:00:13 GMT

i may be able to use

| stats count by tasknumer

I think that might be the answer....

Re: Search in transactions help

diogofgm — Sat, 10 Apr 2021 00:29:22 GMT

Yes, if you have multiple messages “could not get id” per task number you should use the “by tasknumber” clause.

and yes most of the times stats is the answer, not transaction. There are several presentations from .conf regarding using stats instead of transaction.