Splunk Search

Exclude an Event Based on Value From Another Event

jepoyyyy
Explorer

Hi All,

I have a set of log that contains events something similar to this:

Event A
[09-23-16 16:03:35:972] TransactionID(0900001) Request SomeText SomeTxt amount=90

Event B
[09-23-16 16:03:35:973] TransactionID(0900001) Received packet 'HTTP/1.1 200 OK

There are other events for each transaction but I am only interested in these two lines. I need to get the sum of the amount but only for transactions that are successful which is indicated in the next event with status "200 OK"

I'm thinking of using transaction command but it would be too expensive. Are there any approach other that grouping it using transaction command?

Thanks in advance!
-Jeff

0 Karma
1 Solution

alemarzu
Motivator

Hi there jepoyyy,

Assuming that you don't have certain fields already extracted, try this.

main search  | rex "TransactionID\((?<transactionId>\d+)\)\s" | rex "\)\sReceived\spacket\s\S+\s(?<status>\d+)\s\w+$" | stats latest(_time) AS lastTime, sum(amount) AS Amount, values(status) AS Status by transactionId | where Status=200 | convert ctime(lastTime)

Hope it helps.

View solution in original post

alemarzu
Motivator

Hi there jepoyyy,

Assuming that you don't have certain fields already extracted, try this.

main search  | rex "TransactionID\((?<transactionId>\d+)\)\s" | rex "\)\sReceived\spacket\s\S+\s(?<status>\d+)\s\w+$" | stats latest(_time) AS lastTime, sum(amount) AS Amount, values(status) AS Status by transactionId | where Status=200 | convert ctime(lastTime)

Hope it helps.

jepoyyyy
Explorer

Thank you for pointing me to the right direction!

0 Karma

alemarzu
Motivator

I'm glad it helped you! Happy Splunking!

0 Karma

sundareshr
Legend

Try this. if a transaction id can have more than request and response

index=xyz "Request SomeText" OR "Received packet 'HTTP/1.1 200 OK" | rex "TransactionID\((?<id>\d+)\)\s(?<action>Received|Request)" | stats sum(Amount) as Total count(eval(action=Received)) as Recd count(eval(action=Request)) as Req by id | where Recd=Req 
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...