topic Re: How to configure transaction in Splunk Search

How to configure transaction

lain179 — Fri, 09 Nov 2012 18:36:38 GMT

I have user login/out logs to parse. The goal is to get the information on

Active sessions (i.e. no logout time) by server
Total logins over certain period of time by server
Login duration by server

The log files look like

2012-11-08 16:20:02 Start login for user 'ABCDEFG', profile: 'default', session: 'SESSION68811278'.  SERVERNAME

2012-11-08 16:29:10 Log out session 'SESSION68811278'. SERVERNAME

How do I set up transactions for them? Please don't just give me a link to read because I have already read it and I don't get it.

http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Searchfortransactions

Thanks.

Re: How to configure transaction

sdaniels — Fri, 09 Nov 2012 19:53:54 GMT

Assuming you have the data coming into Splunk properly you'll first want to extract out the relevant fields. This wizard will help generate the required regular expression for you. That way you can now have a field called 'session'.

http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/ExtractfieldsinteractivelywithIFX

Then you can simply create a search that creates your transaction using session in this case, it could be a different value or multiple fields as well:

search | transaction session

This will automatically create larger transaction events and a duration field for the time. Given your needs above, once you get to this step we can create several searches to match the transactions by session or server name etc...

If you don't have the data configured in Splunk yet you'll want to start here. It's pretty straightforward.

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Setupcustominputs

Re: How to configure transaction

lain179 — Fri, 09 Nov 2012 20:18:09 GMT

Hi, thanks for responding.

I have already set up field extraction. LoginDate, LogoutDate, UserID, Profile, UserSession, and ServerName. I know how to get what I need using stats and chart, but I want to learn about transaction.

I still don't get your example of

| transaction session

Re: How to configure transaction

sdaniels — Fri, 09 Nov 2012 20:36:52 GMT

Ok. I think this video (5 mins) will help. It's a different use case but you'll see exactly what it does, how the data will look and why. Let me know your thoughts.

http://www.splunk.com/view/SP-CAAAG9X

Re: How to configure transaction

lain179 — Fri, 09 Nov 2012 21:55:27 GMT

Hmm....I didn't think the video would have helped, but it did 🙂

I got the idea on how to apply to my usage now. Thank you.