how to group by transaction type

avikc100 — Mon, 03 Jun 2024 23:17:19 GMT

My Log data looks like:

i am using this query:

index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/CXMLOrders.log" |eval timestamp=strftime(_time, "%F") | chart limit=30 count as count over TransactionType by timestamp

I have to built report on transaction type, total count date wise

please help to form the query,

due to space it is not showing properly

TransactionType = cXML OrderRequest

TransactionType = cXML ConfirmationRequest

Regards

Avik

Re: how to group by transaction type

richgalloway — Mon, 03 Jun 2024 19:51:59 GMT

I presume the problem is the table is very wide. If so, try swapping the terms in the chart command

index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/CXMLOrders.log" | eval timestamp=strftime(_time, "%F") | chart limit=30 count as count over timestamp by TransactionType

Alternatively, try the timechart command.

index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/CXMLOrders.log" | eval timestamp=strftime(_time, "%F") | timechart useother=0 limit=30 count by TransactionType

topic how to group by transaction type in Splunk Search

how to group by transaction type

Re: how to group by transaction type