topic Re: How do I group events by field (trans ID) and count as a single event? in Splunk Search

How do I group events by field (trans ID) and count as a single event?

sglazier — Sat, 18 Jul 2015 05:15:59 GMT

My apologies is this has been asked and answered.

We have logs that record several error entries for a single transaction. We have mapped the transaction ID as a field and would like to group all of the log entries for a particular transaction together to be counted as a single event. Would this be best done as the logs are consumed by Splunk or when searching and how would I go about doing it?

Thanks

Re: How do I group events by field (trans ID) and count as a single event?

woodcock — Sat, 18 Jul 2015 06:15:55 GMT

It is best definitely to do at Search Time ("while searching") and you can use the transaction command but if the events are time-sequenced already, this will be MUCH more efficient:

... | stats list(_raw) AS events BY transactionID

Re: How do I group events by field (trans ID) and count as a single event?

martin_mueller — Sat, 18 Jul 2015 12:43:13 GMT

What do you mean by "counted as a single event"?