Knowledge Management

How to group input and output request log?

MayankMathur198
New Member

We have our webservice logs on splunk having separate request (input) and response(output) log. There is one common unique id field between request and response log. But I want to match events in such a way to have count on basis of "requst_name" from request log and "response_cd" (where response_cd is not "00")from response log.

Example of request and response events:

REQUEST EVENT:

TYPE=REQUEST,ID=ABCDEF,REQUST_NAME=API_LOGGING_INFO, DATE=YYYY-MM-DD,TIME=HH:MM:SS

RESPONSE EVENT :

TYPE=RESPOMSE, ID=ABCDEF,RESPONSE_CODE=00
(Response_cd may have different values)

I have tried transaction commond to group events and then search for non "00" response-cd but search is taking very long time.

Thanks in advance!

Tags (1)
0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

As a starting point does the following help?

( source=request OR source=response ) response_cd != 00
| stats count by id, source
| stats count by id 
| where count > 1
0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...