I'm looking create a table in Splunk which shows me a top 10 list of offending 'stores' which are creating 'duplicate' entries in our logs.
I can identify these duplicate entries by our response code 'V033', so I would like to search on this value but count on the store id which is several lines above. Is there a way to do this?
I have pasted an extract of a logfile below.
21/06/2011 12:12:12.685 Add store 7936424 to cache
.... (multiple lines, say 6 for example)
21/06/2011 12:12:13.083 Set response to V, V033 - Duplicate transaction
I'm a little new to Splunk so still feeling my way around. Thank you in advance.
One way to accomplish this is with the transaction
command. Transaction pulls together related events into a larger event at search time. Transaction normally works best when you have a transaction id / session id / pid / thread name -- something common among the events to stitch them together.
http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction
One way to accomplish this is with the transaction
command. Transaction pulls together related events into a larger event at search time. Transaction normally works best when you have a transaction id / session id / pid / thread name -- something common among the events to stitch them together.
http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction
Thank you, very interesting I'll give that a read. We have a process ID in the same logs which I could use to tie the transaction together (I removed it from my example above for simplicity).