topic Re: How to get latest transactionId ? in Splunk Search

How to get latest transactionId ?

karthi2809 — Fri, 03 May 2024 12:20:57 GMT

Hi All,

I am trying to get count of enabled and disabled from field. Then i want to show the field values based on latest correlation ID.The currstatus field will run for every 10 min.

"content.currStatus"="*" |stats values(content.currStatus) as currStatus by latest(correlationId)|where currStatus!="Interface has no entry found in object Store"|stats count by currStatus

Re: How to get latest transactionId ?

ITWhisperer — Fri, 03 May 2024 12:39:05 GMT

Try something like this

Re: How to get latest transactionId ?

gcusello — Fri, 03 May 2024 12:43:07 GMT

Hi @karthi2809 ,

if currStatus has values enabled or disabled, please try something like this:

"content.currStatus"="*" content.currStatus!="Interface has no entry found in object Store" | rename content.currStatus AS currStatus | stats count(eval(currStatus="enabled"))AS enabled_count count(eval(currStatus="disabled"))AS disabled_count last(currStatus) AS last_currStatus BY correlationId)

In addition one hint: add always the index containing these events: you'll have a faster search and you'll be sure to take events.

Ciao.

Giuseppe

Re: How to get latest transactionId ?

karthi2809 — Fri, 03 May 2024 12:57:37 GMT

Hi @ITWhisperer

The query which is working but i need total counts of enabled and disabled in the output .Now its showing 1 for enabled and 1for disabled.But the event is getting 79

index="mulesoft" applicationName="scheduler" message="Upcoming :*" [search index="mulesoft" applicationName="scheduler" | stats latest(correlationId) as correlationId | table correlationId | format] |stats values(content.currStatus) as currStatus by correlationId|where currStatus!="Interface has no entry found in object Store"|stats count by currStatus There are 79 events in this 74 is enabled and 5 are disabled .The values enabled and disabled from currstatus field.

Re: How to get latest transactionId ?

ITWhisperer — Fri, 03 May 2024 12:59:49 GMT

You don't need the stats values() line

index="mulesoft" applicationName="scheduler" message="Upcoming :*" [search index="mulesoft" applicationName="scheduler" | stats latest(correlationId) as correlationId | table correlationId | format] |where `content.currStatus`!="Interface has no entry found in object Store"|stats count by `content.currStatus`

Re: How to get latest transactionId ?

karthi2809 — Fri, 03 May 2024 13:10:10 GMT

If i remove stats line it will shows 0 events.Not showing any counts

Re: How to get latest transactionId ?

karthi2809 — Fri, 03 May 2024 13:15:40 GMT

Just i want to show the latest correlationId and in your query its showing multiple correlationID and i just want show the count of enabled and disabled in pie chart.

Re: How to get latest transactionId ?

karthi2809 — Fri, 03 May 2024 13:23:42 GMT

Got it thanks its working and latest correlationId .What time frequency the correlationId change.

Re: How to get latest transactionId ?

ITWhisperer — Fri, 03 May 2024 14:39:59 GMT

Apart from you, who else knows how frequently the correlation id changes?

Re: How to get latest transactionId ?

karthi2809 — Fri, 03 May 2024 15:16:47 GMT

Sorry its not working .Sometimes the values coming but sometimes its not showing any values

Re: How to get latest transactionId ?

ITWhisperer — Fri, 03 May 2024 15:21:12 GMT

Please provide examples of what is working and what is not working otherwise just saying it is not working is not very helpful!

Re: How to get latest transactionId ?

karthi2809 — Fri, 03 May 2024 16:33:19 GMT

Hi @ITWhisperer
First time its coming when i am trying to refresh the same query i am not find any values

Query which i am trying: index="mulesoft" applicationName="scheduler" environment=DEV message="Upcoming Executions for Scheduler :*" [search index="mulesoft" applicationName=" scheduler" | stats latest(correlationId) as correlationId | table correlationId | format] |where content.currStatus!="Interface has no entry found in object Store"|stats count by content.currStatus If i use the query in seperate search its showing the latest correlation values: message="Upcoming Executions for Scheduler :*" environment=DEV | stats latest(correlationId) as correlationId | table correlationId