Splunk Search
Highlighted

Get logs with a distinct value of a field

New Member

I saw some similar questions but none seem to work

In my splunk logs, I have this field called TransactionID: 6c5802f0-c317-4d3a-9211-2ed7a10a5d7f -> 46314ef3-dac8-4756-902a-76fc61255d11 in my logs
A transaction can have multiple errors but I just want to find how many transactions did error occur in instead of total number of errors.
In other words, I want logs of distinct TransactionID that has error.

I tried index=bc-dag-app AND ERROR | dedup TransactionID but it didn't work.
Can someone please advise?

PS: I am super-new to splunk so I'm sorry if it's a straight forward/stupid question

0 Karma
Highlighted

Re: Get logs with a distinct value of a field

Path Finder

Hi,

Actually dedup TransactionID should work if you are looking for distinct transactions.

But if you are looking for all the logs per each transaction, you can try transaction command.

index=bc-dag-app AND ERROR | transaction TransactionID

Hope, it helps.

0 Karma
Highlighted

Re: Get logs with a distinct value of a field

New Member

I tried the above query but it did not yield any result. 😕

0 Karma
Highlighted

Re: Get logs with a distinct value of a field

Influencer

@ank15july96 First make sure your TransactionID field is being extracted. If it is, then use below query -

index=bc-dag-app AND ERROR | stats dc(TransactionID) as error_count
0 Karma