https://community.splunk.com/t5/Splunk-Search/How-to-search-for-transactions-associated-with-another-field/m-p/179148#M51566 <P>glad I could help</P> Wed, 01 Jul 2015 07:43:40 GMT aholzel 2015-07-01T07:43:40Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-transactions-associated-with-another-field/m-p/179145#M51563 <P>I have to send automated reports to a partner with logs and MSISDN that failed due to timeout. Logs are divided by steps, so if I look for telephone number:</P> <PRE><CODE>&lt;wstxns1:addresses&gt;tel:573162xxxx&lt;/wstxns1:addresse&gt; </CODE></PRE> <P>I can get them easily, but I don't know if they're failing because the error is showed a step/field after. If I search for the error, it's easy too, but I can't see the phone number associated because it's a step/field before </P> <PRE><CODE>msg=Exception timeout launched when sending a SMS MT to SMS ParlayX Enabler: The timeout period of 30000ms has been exceeded </CODE></PRE> <P>The only field in common between those fields is a correlatorID </P> <PRE><CODE>corr=22cb1367-d04a-47e1-994f-d5df70d98001 </CODE></PRE> <P>If I search with it on my sourcetype, I can get all steps, but I get only that, and I need all of them that are failing... Any idea? <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 26 Jun 2015 11:36:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-transactions-associated-with-another-field/m-p/179145#M51563 mikylace 2015-06-26T11:36:01Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-transactions-associated-with-another-field/m-p/179146#M51564 <P>seems like something for the transaction command</P> <PRE><CODE>base search | transaction correlatorID | ..... </CODE></PRE> <P>also see: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Transaction</A></P> Fri, 26 Jun 2015 12:10:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-transactions-associated-with-another-field/m-p/179146#M51564 aholzel 2015-06-26T12:10:02Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-transactions-associated-with-another-field/m-p/179147#M51565 <P>I found it! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> Thanks man!</P> <P><A href="http://answers.splunk.com/answers/138588/joining-multiple-events-via-a-common-field.html">http://answers.splunk.com/answers/138588/joining-multiple-events-via-a-common-field.html</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.1.7/Search/Abouttransactions">http://docs.splunk.com/Documentation/Splunk/6.1.7/Search/Abouttransactions</A></P> <P>index=pconnectindex sourcetype=parlayx | transaction corr | search lvl=ERROR</P> <P>basically, the "transaction" command groups multiple events into a single meta-event that represents a single physical event. In my case, sending an SMS have generated several events, with the "corr" field in common. To see the failed ones, I just have to "search" for the level "ERROR".</P> <P>Piece of cake!<BR /> thankyou so much!</P> Mon, 29 Jun 2015 12:16:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-transactions-associated-with-another-field/m-p/179147#M51565 mikylace 2015-06-29T12:16:29Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-transactions-associated-with-another-field/m-p/179148#M51566 <P>glad I could help</P> Wed, 01 Jul 2015 07:43:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-transactions-associated-with-another-field/m-p/179148#M51566 aholzel 2015-07-01T07:43:40Z