topic Re: Finding Status in Transaction in Splunk Search

Finding Status in Transaction

Mubarish — Fri, 11 Jul 2014 09:57:44 GMT

Hi
I have a set of logs over which the transaction command is applied for SessionID and some fields are extracted .Below is the sample result.


SessionID	FileName	StatusCode
814xxx	Setxxxx.csv	0
		0
		0
814xxx	xxx.ZIP.asc	0
	xxx.ZIP.asc	91
	xxx.ZIP.asc	1481
		0
814xxx		0

The Status will be FAILURE if any of the StatusCode value for a particular SessionID have non Zero value otherwise Status will be COMPLETED

The expected output is


SessionID	FileName	StatusCode	StatusCode
814xxx	Setxxxx.csv	0	COMPLETED
		0
		0
814xxx	xxx.ZIP.asc	0	FAILURE
	xxx.ZIP.asc	91
	xxx.ZIP.asc	1481
		0
814xxx		0	COMPLETED

How can i do this?

Re: Finding Status in Transaction

strive — Fri, 11 Jul 2014 11:15:32 GMT

Pipe the transaction results and use the eval command

Re: Finding Status in Transaction

jimodonald — Fri, 11 Jul 2014 12:47:50 GMT

Could you sum the StatusCode and use an IF statement to identify the FAILURE/COMPLETED ?

i.e.

 ...  | stats sum(StatusCode) by SessionID | eval StatusCode=if(StatusCode==0,"COMPLETED","FAILURE") ...

Re: Finding Status in Transaction

somesoni2 — Fri, 11 Jul 2014 13:26:33 GMT

You can try any of these

Your base search | eval StatusCode=if(StatusCode=0,"COMPLETED","FAILURE") | your transaction command | eval StatusCode=if(mvcount(StatusCode)=2,"FAILURE",StatusCode)


Your search with transaction command | eventstats sum(StatusCode) as AggrStatusCode by SessionID | eval StatusCode=if(AggrStatusCode=0,"COMPLETED","FAILURE")