Group together events that do not have a common field values

nitishnair123 — Thu, 05 Nov 2015 09:09:36 GMT

I have a log file from which I am pasting a particular group of events as below:

EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:26:23 Invoking JMS Java method Receive
ObjMgrBusServiceLog InvokeMethod 4 00000229560a1489:0 2015-09-30 14:26:23 Begin: Business Service 'EAI JMS Java Business Service Caller' invoke method: 'Receive' at 982c218
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:26:23 Begin Creating instance of java property set
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:26:23 Begin copying properties and type
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:26:23 Finished copying properties and type
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:26:23 Finished copying value
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:26:23 End Creating instance of java property set
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Business Service Invoke Complete
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Begin Creating instance of output property set
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Finished copying properties
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Finished copying type
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Finished copying value
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 End Creating instance of output property set
ObjMgrBusServiceLog InvokeMethod 4 00000229560a1489:0 2015-09-30 14:27:43 Business Service 'EAI JMS Java Business Service Caller' invoke method 'Receive' Execute Time: 80.016 seconds.
ObjMgrBusServiceLog InvokeMethod 4 00000229560a1489:0 2015-09-30 14:27:43 End: Business Service 'EAI JMS Java Business Service Caller' invoke method: 'Receive' at 982c218
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Invoking JMS Java method Commit
ObjMgrBusServiceLog InvokeMethod 4 00000229560a1489:0 2015-09-30 14:27:43 Begin: Business Service 'EAI JMS Java Business Service Caller' invoke method: 'Commit' at 982c218
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Begin Creating instance of java property set
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Begin copying properties and type
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Finished copying properties and type
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Finished copying value
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 End Creating instance of java property set
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Business Service Invoke Complete
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Begin Creating instance of output property set
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Finished copying properties
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Finished copying type
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 Finished copying value
EAITransport EAITransportDebug 4 00000229560a1489:0 2015-09-30 14:27:43 End Creating instance of output property set
ObjMgrBusServiceLog InvokeMethod 4 00000229560a1489:0 2015-09-30 14:27:43 Business Service 'EAI JMS Java Business Service Caller' invoke method 'Commit' Execute Time: 0.008 seconds.
ObjMgrBusServiceLog InvokeMethod 4 00000229560a1489:0 2015-09-30 14:27:43 End: Business Service 'EAI JMS Java Business Service Caller' invoke method: 'Commit' at 982c218
ObjMgrBusServiceLog InvokeMethod 4 00000229560a1489:0 2015-09-30 14:27:43 Business Service 'EAI JMS Transport' invoke method 'ReceiveDispatch' Execute Time: 80.025 seconds.

These events may occur multiple times with the below pattern observed in sequence in which these events occur:

This event will always come at the beginning of the group ->
EAITransport EAITransportDebug 4 xxxxxxxxxxxxxxxx:0 xxxx-xx-xx xx:xx:xx Invoking JMS Java method Receive
This event will always mark the end of the group ->
ObjMgrBusServiceLog InvokeMethod 4 xxxxxxxxxxxxxxxx:0 xxxx-xx-xx xx:xx:xx Business Service 'EAI JMS Transport' invoke method 'ReceiveDispatch' Execute Time: xx.xxx seconds.

The aim is to be able to group all these events (that lie between and including the 2 boundary events) together.
I have tried using 'transaction', but from what I understand, that would need some unique field-value in each of these events that are to be grouped together. In this case, there doesn't seem to be any. Wondering if there is any way to achieve this.

Re: Group together events that do not have a common field values

asimagu — Thu, 05 Nov 2015 09:50:38 GMT

have you tried creating a mock-up field before building your transactions?

Re: Group together events that do not have a common field values

nitishnair123 — Thu, 05 Nov 2015 10:16:16 GMT

Do you mean creating a new field and have that in all events that should comprise a transaction with a same value? I would have tried doing that, but the challenge here seems to be what value would I populate the mock field with? In the case above, I would then need to have dummy values that change for every group of common events that would define a transaction. The boundary events that define the start and end of the transaction would always be the same (of course apart from the timestamp field). Also to be noted that there can any number of events between the 2 boundary events.

Re: Group together events that do not have a common field values

asimagu — Thu, 05 Nov 2015 10:48:58 GMT

hummm, if the timestamp is the same, maybe you could use _time as that field, or a mockup field that may contain that _time value..... I cannot be sure, as I never faced that situation. It may worth trying?

Re: Group together events that do not have a common field values

nitishnair123 — Thu, 05 Nov 2015 11:11:03 GMT

Thanks asimagu...but the timestamp will vary as and when these events get logged in the log file in sequence.

topic Re: Group together events that do not have a common field values in Splunk Search

Group together events that do not have a common field values

Re: Group together events that do not have a common field values

Re: Group together events that do not have a common field values

Re: Group together events that do not have a common field values

Re: Group together events that do not have a common field values