Archive

query to extract events with distict ids

wye054
New Member

Hi

i am trying to get all the request messages that passed through our application for a particular time frame . when i am searching using
sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error")

getting below events with repeatition of transaction ids . How to get distict tid instead of repeating tids ....
please help me on this , i am a newbea to this ...
Time Event 1 1/13/14
11:20:54.000 PM
Mon Jan 13 2014 23:20:54 tid(7677232): certificate validation succeeded
date_month = january host = dev source = /opt/store/off_device_logging/Leg.log.
sourcetype = Leg .log
2 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 tid(34223): Updating existing wsdl
date_month = january host = dev
source = /opt/store/off_device_logging/Leg .log sourcetype = Leg .log
3 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20 : tid(34223😞 wsdl Compilation Request
date_month = january host = dev source = /opt/store/off_device_logging/Leg .log
sourcetype = Leg .log
4 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 : tid(8006898): HTTP response code 200
date_month = january host = dev source = /opt/store/off_device_logging/Leg .log
sourcetype = Leg .log
5 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 tid(8006898): certificate validation succeeded
date_month = january host = dev
source = /opt/store/off_device_logging/Leg .log sourcetype = Leg .log

Tags (1)
0 Karma

somesoni2
Revered Legend

If the field tid or transactionId is already extracted use following

sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error") | dedup tid

If the tid field is not extracted, use following

sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error") | rex "\((?<tid>.*)\)" | dedup tid

you can save the regex to make it search time field extraction.

0 Karma

linu1988
Champion

Hello,
I would assume all the events are different, so we can have the tid's first then you can have your calculations

sourcetype="*Leg  .log" tid |rex field=_raw "\stid\((?<TID>\d+)"|dedup TID|eval status = if(error == 200, "OK", "Error") 

Give it a try. Thanks

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.