topic Re: How do I search for the Errored Transaction_IDs ONLY, then take those Errored TIDs and search for each entry related to them? in Splunk Search

How do I search for the Errored Transaction_IDs ONLY, then take those Errored TIDs and search for each entry related to them?

shariefc — Wed, 31 Aug 2016 19:18:37 GMT

index=my_server sourcetype=server1_log NOT "status=SUCCESS" "client_id=my_client"

returns

TID=0101010101 client_id=my_client action=response status=ERROR 
TID=0101010102 client_id=my_client action=response status=ERROR 
TID=0101010103 client_id=my_client action=response status=ERROR

Now I want to take the list of Errored TIDs the first search returns and do another search that returns everything related to each TID including the parts that were successful.

TID=0101010101 client_id=my_client action=request status=SUCCESS
TID=0101010101 client_id=my_client action=begin status=SUCCESS
TID=0101010101 client_id=my_client action=middle status=SUCCESS
TID=0101010101 client_id=my_client action=end status=SUCCESS
TID=0101010101 lient_id=my_client action=response status=ERROR
...
TID=0101010102 client_id=my_client action=request status=SUCCESS
TID=0101010102 client_id=my_client action=begin status=SUCCESS
TID=0101010102 client_id=my_client action=middle status=SUCCESS
TID=0101010102 client_id=my_client action=end status=SUCCESS
TID=0101010102 lient_id=my_client action=response status=ERROR
...
TID=0101010103 client_id=my_client action=request status=SUCCESS
TID=0101010103 client_id=my_client action=begin status=SUCCESS
TID=0101010103 client_id=my_client action=middle status=SUCCESS
TID=0101010103 client_id=my_client action=end status=SUCCESS
TID=0101010103 client_id=my_client action=response status=ERROR

Re: How do I search for the Errored Transaction_IDs ONLY, then take those Errored TIDs and search for each entry related to them?

sundareshr — Wed, 31 Aug 2016 20:24:35 GMT

Try this

index=my_server sourcetype=server1_log | extract pairdelim=" " kvdelim="=" | eventstats count(eval(status="ERROR")) as err by client_id TID | where err>0

Re: How do I search for the Errored Transaction_IDs ONLY, then take those Errored TIDs and search for each entry related to them?

ryoji_solsys — Thu, 01 Sep 2016 16:39:09 GMT

Would you like to try this ...

index=my_server sourcetype=server1_log  [ | search index=my_server sourcetype=server1_log NOT "status=SUCCESS" "client_id=my_client" | fields TID]

Re: How do I search for the Errored Transaction_IDs ONLY, then take those Errored TIDs and search for each entry related to them?

ryoji_solsys — Thu, 01 Sep 2016 16:41:58 GMT

If you want all the events to be in one transaction, just add | transaction fields=TID at the end of the query above.

E.g.

index=my_server sourcetype=server1_log [ | search index=my_server sourcetype=server1_log NOT "status=SUCCESS" "client_id=my_client" | fields TID] | transaction fields=TID

Re: How do I search for the Errored Transaction_IDs ONLY, then take those Errored TIDs and search for each entry related to them?

shariefc — Thu, 01 Sep 2016 23:51:02 GMT

Thanks sundareshr I tried this but it was not exactly what I wanted. Maybe I didn't explain myself properly.

Re: How do I search for the Errored Transaction_IDs ONLY, then take those Errored TIDs and search for each entry related to them?

shariefc — Thu, 01 Sep 2016 23:52:11 GMT

This worked perfctly. Thanks ryoji_solsys.

Re: How do I search for the Errored Transaction_IDs ONLY, then take those Errored TIDs and search for each entry related to them?

shariefc — Thu, 01 Sep 2016 23:54:47 GMT

This worked perfctly. Thanks ryoji_solsys.

transaction fields=TID

WOW!!!! I think you know what I wanted better than I did. This is perfect!!!!! Thanks for all the help everyone.