topic Re: using the filename as a transaction id in Splunk Search

using the filename as a transaction id

krugger — Mon, 28 Sep 2020 13:53:43 GMT

Hi,

I am trying to integrate into splunk a Java application that generates per session logfiles. So I have lots of independente files that have interesting lines like:

Task Param 3 2013-05-14 08:00:00 Server : farm01

... (useless lines) ...

Session Login 3 2013-05-04 08:45:22 Username: testuser, Login Status: Attempt, Session ID: Zgea*censored*, IP Address: 192.168.1.100

... ( more useless lines) ...

ObjMgr InvokeMethod 4 00003682516f22dc:0 2013-04-18 09:05:38 Begin: Service 'Web Engine Properties' invoke method: 'IsFrameless' at 15636ba6

... ( lots more of invoke method lines ) ...

How can I relate the invoke messages to the user that is doing the invoking. I do not have any field I can use to make the transaction feature work. However as the application creates a file for each of the sessions I can use the filename/source as a transaction id.

Is it possible to use the source/filename as the transaction id? Or is there a differente approach?

Re: using the filename as a transaction id

yannK — Tue, 14 May 2013 14:52:31 GMT

yes you can.
* | transaction source

and if you want to extract the session from a part of the source, use a rex extraction to generate the field
example mypath/to/my/file/sessionnumber.log

* | rex field=source "blah/(<?session>\d+)\.log" | transaction session

Re: using the filename as a transaction id

krugger — Tue, 14 May 2013 15:01:08 GMT

The transaction doesn't allow for over 500 lines per transaction and the files have way too many lines. They are between 5Mb and over 100Mb.

Re: using the filename as a transaction id

Ayn — Tue, 14 May 2013 19:59:30 GMT

So what you're saying is that the filename can't be used after all either?

I think you need to formulate first of all what rule could be used for tying events together. After that it's just a matter of translating that to something in Splunk.

Re: using the filename as a transaction id

yannK — Tue, 14 May 2013 20:20:13 GMT

If you have long events, transaction is not the solution.
Can you explicit what is your goal and why you think that you needed a transaction ?