Search & count on value from line above

[fwd4]

I'm looking create a table in Splunk which shows me a top 10 list of offending 'stores' which are creating 'duplicate' entries in our logs.

I can identify these duplicate entries by our response code 'V033', so I would like to search on this value but count on the store id which is several lines above. Is there a way to do this?

I have pasted an extract of a logfile below.

21/06/2011 12:12:12.685 Add store 7936424 to cache
.... (multiple lines, say 6 for example)
21/06/2011 12:12:13.083 Set response to V, V033 - Duplicate transaction

I'm a little new to Splunk so still feeling my way around. Thank you in advance.

[dwaddle · Accepted solution]

One way to accomplish this is with the transaction command. Transaction pulls together related events into a larger event at search time. Transaction normally works best when you have a transaction id / session id / pid / thread name -- something common among the events to stitch them together.

http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

[fwd4]

Thank you, very interesting I'll give that a read. We have a process ID in the same logs which I could use to tie the transaction together (I removed it from my example above for simplicity).