Archive

How to group input and output request log?

New Member

We have our webservice logs on splunk having separate request (input) and response(output) log. There is one common unique id field between request and response log. But I want to match events in such a way to have count on basis of "requstname" from request log and "responsecd" (where response_cd is not "00")from response log.

Example of request and response events:

REQUEST EVENT:

TYPE=REQUEST,ID=ABCDEF,REQUSTNAME=APILOGGING_INFO, DATE=YYYY-MM-DD,TIME=HH:MM:SS

RESPONSE EVENT :

TYPE=RESPOMSE, ID=ABCDEF,RESPONSECODE=00
(Response
cd may have different values)

I have tried transaction commond to group events and then search for non "00" response-cd but search is taking very long time.

Thanks in advance!

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

As a starting point does the following help?

( source=request OR source=response ) response_cd != 00
| stats count by id, source
| stats count by id 
| where count > 1
0 Karma