topic Re: Grouping logs by tranId, date and time in Splunk Search

Grouping logs by tranId, date and time

msarkaus — Wed, 02 Oct 2024 18:42:47 GMT

Hello,

I'm attempting to display a group of logs by the tranId. We log multiple user actions under a single tranId. I'm attempting to group all of the logs for a single tranId in my dashboard.

I think I figured out how I want to display the logs, but I can't get the datetime format to correctly display.

index blah blah

| eval msgTxt=substr(msgTxt, 1, 141) | stats list(_time) as DateTime list(msgTxt) as Message list(polNbr) as QuoteId by tranId | eval time=strftime(_time," %m-%d-%Y %I:%M:%S %p") | streamstats count as log by tranId | eval tranId=if(log=1,tranId,"") | fields - log

Please help with displaying date and time format.

Thanks

Re: Grouping logs by tranId, date and time

gcusello — Wed, 02 Oct 2024 17:24:45 GMT

Hi @msarkaus ,

after a stats command, you have only the fields in the stats command, so you don't have yet the _time field,

in affirion, if you use the list option in the stats command you probably have too many values, so try values instead list,

try something like this:

Ciao.

Giuseppe

Re: Grouping logs by tranId, date and time

gcusello — Mon, 07 Oct 2024 14:06:35 GMT

Hi @msarkaus ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉