Knowledge Management

How to group input and output request log?

New Member

We have our webservice logs on splunk having separate request (input) and response(output) log. There is one common unique id field between request and response log. But I want to match events in such a way to have count on basis of "requst_name" from request log and "response_cd" (where response_cd is not "00")from response log.

Example of request and response events:




(Response_cd may have different values)

I have tried transaction commond to group events and then search for non "00" response-cd but search is taking very long time.

Thanks in advance!

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

As a starting point does the following help?

( source=request OR source=response ) response_cd != 00
| stats count by id, source
| stats count by id 
| where count > 1
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...