Getting Data In

How to restrict transaction to group events from the same source and the same host?

xinde
Path Finder
  • Search a same log file on many different hosts .
  • Use transaction : startwith and endwith to capture one process within this log file.
  • Show the duration of this process for each host/source

    host="hosts"
    | rex field=_raw "Process(?.*)"
    | transaction ProcessName startswith="BEGIN" endswith="END"
    | eval durationMin = round(duration/60,0)
    | chart values(durationMin) by host
    The search return - msg from different host/source got grouped together.
    Is there a way to restrict transaction events only on same host/source?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try using stats instead of chart.

host="*hosts*" 
| rex field=_raw "Process(?<ProcessName>.*)" 
| transaction  ProcessName startswith="BEGIN" endswith="END"
| eval durationMin = round(duration/60,0)
| stats values(durationMin) by host, source

If you share some sample events, we may be able to help you improve search performance by eliminating the transaction command.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using stats instead of chart.

host="*hosts*" 
| rex field=_raw "Process(?<ProcessName>.*)" 
| transaction  ProcessName startswith="BEGIN" endswith="END"
| eval durationMin = round(duration/60,0)
| stats values(durationMin) by host, source

If you share some sample events, we may be able to help you improve search performance by eliminating the transaction command.

---
If this reply helps you, Karma would be appreciated.
0 Karma

xinde
Path Finder

stats by host , source works!! thanks very much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...