Hi
I do have logs which has the timestamps and the structure like: Start Perfomance Logging: [txID=123456-SOC98678-SOS87596]
:
The log with txID=123456 is stored several times with different timestamps. Like:
6:14:13:784 PM Start Perfomance Logging: [txID=123456-SOC98678-SOS87596], ......
6:14:13:788 PM Start Perfomance Logging: [txID=123456-SOC98678-SOS87596], ......
6:14:13:797 PM End Perfomance Logging: [txID=123456-SOC98678-SOS87596], ......
Now I wish to list all the sub- transactions of txID=123456 occured in different timestamps in a nested form. Also, for a given transaction, I wish to show the rest transaction with the same number in nested form. How could I achieve this?
Thanks in advance for the information.
Take a look at the transaction command.
.. | transaction txID startswith="Start Performance Logging" endswith="End Performance Logging"
More info here http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Transaction