All Apps and Add-ons

Example of how to track a transaction across multiple servers?

sloshburch
Splunk Employee
Splunk Employee

Does anyone have examples of how to use Splunk to track a transaction across multiple servers?

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

Application support teams can get a single aggregate view of multiple user HTTP requests across many web servers during a single browsing session.

Load data

How to implement: This example use case depends on data from web server logs.

Install the Splunk Add-on for Apache Web Server or the Splunk Add-on for Microsoft IIS. Follow the documentation to learn how to install these add-ons. Find the Splunk Add-on for Apache Web Server and the Splunk Add-on for Microsoft IIS on Splunkbase.

Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.

Run the following search to verify you are searching for normalized web data that is ready for this use case:

earliest=-1day index=* tag=web
| head 10

Get insights

Use the IP address of a user in the web access logs to see how that user has interacted with a site. The example search here shows the total amount of time a single user's IP address has interacted with the application. Replace the example IP address 180.202.226.165 with a user's IP address from your environment.

Run the following search.

index=* "180.202.226.165" tag=web
((uri_path IN ("/", "*view*","*category*", "*detail*", "*basket*")) OR (uri_path IN ("*cart*") method="POST"))
| stats earliest(_time) as first_event_time latest(_time) as last_event_time
| eval total_site_time=tostring(last_event_time-first_event_time,"duration")
| table total_site_time

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

Application support teams can get a single aggregate view of multiple user HTTP requests across many web servers during a single browsing session.

Load data

How to implement: This example use case depends on data from web server logs.

Install the Splunk Add-on for Apache Web Server or the Splunk Add-on for Microsoft IIS. Follow the documentation to learn how to install these add-ons. Find the Splunk Add-on for Apache Web Server and the Splunk Add-on for Microsoft IIS on Splunkbase.

Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.

Run the following search to verify you are searching for normalized web data that is ready for this use case:

earliest=-1day index=* tag=web
| head 10

Get insights

Use the IP address of a user in the web access logs to see how that user has interacted with a site. The example search here shows the total amount of time a single user's IP address has interacted with the application. Replace the example IP address 180.202.226.165 with a user's IP address from your environment.

Run the following search.

index=* "180.202.226.165" tag=web
((uri_path IN ("/", "*view*","*category*", "*detail*", "*basket*")) OR (uri_path IN ("*cart*") method="POST"))
| stats earliest(_time) as first_event_time latest(_time) as last_event_time
| eval total_site_time=tostring(last_event_time-first_event_time,"duration")
| table total_site_time

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...