Splunk Search

Exclude an Event Based on Value From Another Event

jepoyyyy
Explorer

Hi All,

I have a set of log that contains events something similar to this:

Event A
[09-23-16 16:03:35:972] TransactionID(0900001) Request SomeText SomeTxt amount=90

Event B
[09-23-16 16:03:35:973] TransactionID(0900001) Received packet 'HTTP/1.1 200 OK

There are other events for each transaction but I am only interested in these two lines. I need to get the sum of the amount but only for transactions that are successful which is indicated in the next event with status "200 OK"

I'm thinking of using transaction command but it would be too expensive. Are there any approach other that grouping it using transaction command?

Thanks in advance!
-Jeff

0 Karma
1 Solution

alemarzu
Motivator

Hi there jepoyyy,

Assuming that you don't have certain fields already extracted, try this.

main search  | rex "TransactionID\((?<transactionId>\d+)\)\s" | rex "\)\sReceived\spacket\s\S+\s(?<status>\d+)\s\w+$" | stats latest(_time) AS lastTime, sum(amount) AS Amount, values(status) AS Status by transactionId | where Status=200 | convert ctime(lastTime)

Hope it helps.

View solution in original post

alemarzu
Motivator

Hi there jepoyyy,

Assuming that you don't have certain fields already extracted, try this.

main search  | rex "TransactionID\((?<transactionId>\d+)\)\s" | rex "\)\sReceived\spacket\s\S+\s(?<status>\d+)\s\w+$" | stats latest(_time) AS lastTime, sum(amount) AS Amount, values(status) AS Status by transactionId | where Status=200 | convert ctime(lastTime)

Hope it helps.

jepoyyyy
Explorer

Thank you for pointing me to the right direction!

0 Karma

alemarzu
Motivator

I'm glad it helped you! Happy Splunking!

0 Karma

sundareshr
Legend

Try this. if a transaction id can have more than request and response

index=xyz "Request SomeText" OR "Received packet 'HTTP/1.1 200 OK" | rex "TransactionID\((?<id>\d+)\)\s(?<action>Received|Request)" | stats sum(Amount) as Total count(eval(action=Received)) as Recd count(eval(action=Request)) as Req by id | where Recd=Req 
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...