topic Re: Transaction in Splunk Search

Transaction

ncbshiva — Tue, 02 Jul 2013 11:00:04 GMT

This is my search query
source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry".

Now i want to evaluate count of "Errors" word from the above result.

Please help me..........

Re: Transaction

linu1988 — Tue, 02 Jul 2013 11:08:15 GMT

Please provide sample log.

Re: Transaction

ChhayaV — Tue, 02 Jul 2013 11:29:03 GMT

hi,
Append search Errors to your query

source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry" | search Errors | stats count

hope this helps

Re: Transaction

ncbshiva — Tue, 02 Jul 2013 12:17:01 GMT

I am not getting proper count ........

Re: Transaction

ncbshiva — Tue, 02 Jul 2013 12:25:32 GMT

This is the sample log

[M2E-CSI]2013-06-11 01:19:40,924 PDT - Hydra is starting Control Channel
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable

Re: Transaction

ncbshiva — Tue, 02 Jul 2013 12:26:21 GMT

Please see the sample log and help me to get the count of "Error"

Re: Transaction

ncbshiva — Tue, 02 Jul 2013 12:30:33 GMT

Example i should get the count of "Error" word as 5

Re: Transaction

ChhayaV — Wed, 03 Jul 2013 04:27:07 GMT

hi,
if you will not use transaction simply right
source="-----.log" Error |stats count

you will get count as 5