transaction too complex?

Yarsa — Mon, 13 Feb 2012 17:53:49 GMT

Hi, I'm trying to create a report that does the same search for two different dates, the regular search uses a transaction:

(sourcetype="bi_log" "join room success")  OR (source="analyticsreport" eventDescription concurrentUsers>0) | transaction eventId | stats  dc(userId) as "Visitors"   count(sessionId) as "Visits" dc(roomId) as "Total rooms"  by eventDescription

For the current report I want to run it for today and 24h X DAYS AGO.
The finale report I will categorize by eventDescription as before but also by "day"

I tried several different times with no success, here is one of them:

(sourcetype="bi_log" "join room success" | append  [search sourcetype="bi_log" "join room success" earliest="-5d@d" latest="-4d@d"] | convert timeformat="%m/%d/%y" ctime(_time) as "new_t") OR (source="analyticsreport" eventDescription concurrentUsers>0  | append  [search source="analyticsreport" eventDescription concurrentUsers>0  earliest="-5d@d" latest="-4d@d"] | convert timeformat="%m/%d/%y" ctime(_time) as "new_t") |  transaction eventId |  stats  dc(userId) as "Visitors"  count(sessionId) as "Visits"  dc(roomId) as "Total rooms" by eventDescription,new_t

I'll appreciate if any of you has suggestions, thanks!!

Re: transaction too complex?

meishar — Tue, 14 Feb 2012 07:39:16 GMT

I have the same problem!!
anyone?

Re: transaction too complex?

lpolo — Tue, 21 Feb 2012 19:28:00 GMT

If you provide a log event sample for each source log I will be able to help you.

topic Re: transaction too complex? in Splunk Search

transaction too complex?

Re: transaction too complex?

Re: transaction too complex?