Splunk Agent logs do not have unique identifier to differentiate multiple jdbc executeQuery entry and exits in the same thread

[ravinukala]

1. Tomcat java web app talking to oracle database.
2. While inserting/updating the database as a part of same thread, there is no unique identifier to correlate the multiple entry/exit for the methods.

[Damien_Dallimor · Accepted solution]

The timestamp of the when the executeQuery method was entered should be unique within the same thread ID and should give you the uniqueness you require for your SPL searches.

[ravinukala]

Yes but i need to calculate the time taken by the method (Time taken by the query). If there are two entries and two exits, how do i correlate the entry and exit ... timestamp doesnt help in that case.

Say
1 - executeQuery - method_entry
2 - executeQuery - method_exit
3 - executeQuery - method_entry
4 - executeQuery - method_exit

in the above case, how do i know which method_exit is for #1 (is it #2 or #4)

[Damien_Dallimor]

Well , if they are all traced under the same thread ID , execution will be synchronous and sequential within the thread , ergo , the method_exit for method_entry 1 will be the first method_exit in order of timestamps, and so on.

[ravinukala]

Great.. thanks for that mate ...