https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200626#M58177 <P>the log source is also same bro..</P> Wed, 11 Jan 2017 22:20:47 GMT prashanthberam 2017-01-11T22:20:47Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200615#M58166 <P>Hi everybody ...<BR /> i have these kind of logs in my environment. every transaction has these 4 log messages but there is no unique id for every transaction. simply it's generating this kind of message, but there is no information to correlate this information for 1 particular transaction. but i need to find the INFORMATION whatever in between inbound and outbound. can anyone help me in that?</P> <P>Thanks in advance.![alt text][1]</P> Thu, 15 Dec 2016 21:37:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200615#M58166 prashanthberam 2016-12-15T21:37:04Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200616#M58167 <P>Can there be more that one transactions going one at the same time?</P> Thu, 15 Dec 2016 21:46:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200616#M58167 somesoni2 2016-12-15T21:46:06Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200617#M58168 <P>No for each transaction their is diff of some milliseconds.</P> Thu, 15 Dec 2016 21:55:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200617#M58168 prashanthberam 2016-12-15T21:55:32Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200618#M58169 <P>Give this a try. This should group relevant transaction events together. </P> <PRE><CODE>Your base search | eval transfield=if(searchmatch("Outbound Message"),1,0) | accum transfield | transaction transfield </CODE></PRE> <P>If you're looking for specific output, please provide a sample/details of that.</P> Thu, 15 Dec 2016 22:01:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200618#M58169 somesoni2 2016-12-15T22:01:59Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200619#M58170 <P>index=ccsp_test_was source="/usr/WASLogs700/cdhpws_uat*_<EM>/cdhpws/logs/application.log" "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" <BR /> AND "Outbound Message" OR "Inbound Message" OR "getProcedureDetailBlueChip response time returning procedure details" OR "memZipCode assigned to zipCode" <BR /> OR "provZipCode assigned to zipCode" OR "bnftAgrmtNbr" |rex "(?Inbound|Outbound)" |eval transfield=if(searchmatch("Outbound Message"),1,0) | accum transfield | transaction transfield | rex "ID:(?.</EM>)" <BR /> |rex "(?m)(?.<EM>)"|rex "(?m)(?.</EM>)"|rex "(?m)(?.<EM>)"|rex "(?.</EM>)" |rex "(?.<EM>)"|rex "(?.</EM>)" | rex "(?.<EM>)" | rex "(?.</EM>)" |rex "(?.<EM>)" |rex "(?.</EM>)"|rex "(?.<EM>)"| rex "(?.</EM>)"|rex "(?.<EM>)" |rex "provZipCode assigned to zipCode:(?.</EM>)"| rex "memZipCode assigned to zipCode:(?.*)"|stats max(_time) as startTime,min(_time) as endTime,values(info) as Info,values(ResponseTime) as responseTime,values(StatusCode) as StatusCode,values(message) as StatusMessage,values(CorpEntCd) as corpEntCd,values(costlvlpctl) as Costlvlpctl,values(CptCode) as cptCode,values(GroupNbr) as GroupNbr,values(MemZipCode) as memZipCode,values(procdchrgamt) as ProcChrgamt,values(ProvZipCode) as ProvZipCode,values(SectionNbr) as SectionNbr,values(ServiceDate) as ServiceDate,values(tretcatcd) as TretCatCd,values(tretcatname) as TretCatName,values(bnftAgrmtNbr) as bnftAgrmtNbr,values(acctNbr) as acctNbr,values(provassignZip) as provassignZip,values(memzipassignzip) as memzipassignzip by id,source<BR /> |eval responseTime=startTime-endTime |eval StartTime=strftime(startTime,"%Y-%m-%d %H:%M:%S,%3N")|eval EndTime=strftime(endTime,"%Y-%m-%d %H:%M:%S,%3N")<BR /> |table id,Info,StartTime,EndTime,responseTime,StatusCode,StatusMessage,source,corpEntCd,Costlvlpctl,cptCode,GroupNbr,memZipCode,ProcChrgamt,ProvZipCode,SectionNbr,ServiceDate,TretCatCd,TretCatName,bnftAgrmtNbr,acctNbr,provassignZip,memzipassignzip</P> <P>could you please help me in this while adding those above code into my search am getting results but responsetime is coming because am loosing the time for outbound message because i nedd to display the transaction starttime endtime in the final result...thanks in advance.. </P> Tue, 29 Sep 2020 12:08:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200619#M58170 prashanthberam 2020-09-29T12:08:16Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200620#M58171 <P>index=ccsp_prd_was source="/usr/WASLogs700/cdhpws_<EM>/cdhpws/logs/application.log" "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" AND "Inbound Message" OR "Outbound Message" OR "getProcedureDetailBlueChip response time returning procedure details" OR "memZipCode assigned to zipCode" OR "provZipCode assigned to zipCode" OR "bnftAgrmtNbr" | rex "ID:(?.</EM>)" |rex "(?Inbound|Outbound)" | eval transfield=if(searchmatch("Outbound Message"),1,0) | accum transfield | transaction transfield by id.....<BR /> am using this query in the production ...Their has 1 or 2 requests not properly combined because ,,,for those requests will have first outbound message and afterwards inbound message.......could you please tell me how can i change the query....<BR /> thanks in advance....</P> Tue, 29 Sep 2020 12:26:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200620#M58171 prashanthberam 2020-09-29T12:26:19Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200621#M58172 <P>Any specific reasons why the outbound message came before inbound? My answers rely on the order of inbound and outbound messages and will not work if the order is changed.</P> Wed, 11 Jan 2017 21:13:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200621#M58172 somesoni2 2017-01-11T21:13:31Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200622#M58173 <P>I don't Know... Even i have check the timestamp..time stamp is good ...once inbound processed then only outbound message processing ..but in the logs it has written like that..for some of the requests...</P> Wed, 11 Jan 2017 21:40:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200622#M58173 prashanthberam 2017-01-11T21:40:25Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200623#M58174 <P>May be your need to sort the events by timestamp so that order is proper? Try adding <CODE>| sort 0 -_time</CODE> before <CODE>eval transfield</CODE>.</P> Wed, 11 Jan 2017 21:58:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200623#M58174 somesoni2 2017-01-11T21:58:37Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200624#M58175 <P>sometimes simultaneously 2 requests are processing ...that's why i am getting the at a time 2 Inbound and outbound messages.... like this order<BR /> outbound 28773<BR /> inbound 28773<BR /> outbound 28772<BR /> outbound 28771<BR /> inbound 28772<BR /> inbound 28771</P> Wed, 11 Jan 2017 22:01:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200624#M58175 prashanthberam 2017-01-11T22:01:31Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200625#M58176 <P>It would be really difficult to differentiate two concurrent simultaneously without a unique identifier. May be check with log source on how you can get that added. </P> Wed, 11 Jan 2017 22:14:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200625#M58176 somesoni2 2017-01-11T22:14:17Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200626#M58177 <P>the log source is also same bro..</P> Wed, 11 Jan 2017 22:20:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-all-events-for-a-transaction-if-there-is-no/m-p/200626#M58177 prashanthberam 2017-01-11T22:20:47Z