Grouping logs by tranId, date and time

[msarkaus]

Hello,

I'm attempting to display a group of logs by the tranId. We log multiple user actions under a single tranId.  I'm attempting to group all of the logs for a single tranId in my dashboard.

I think I figured out how I want to display the logs, but I can't get the datetime format to correctly display.

index blah blah

| eval msgTxt=substr(msgTxt, 1, 141) 
| stats list(_time) as DateTime list(msgTxt) as Message list(polNbr) as QuoteId by tranId
| eval time=strftime(_time," %m-%d-%Y %I:%M:%S %p")
| streamstats count as log by tranId
| eval tranId=if(log=1,tranId,"")
| fields - log

Please help with displaying date and time format.

Thanks 

[gcusello · Accepted solution]

Hi @msarkaus ,

after a stats command, you have only the fields in the stats command, so you don't have yet the _time field,

in affirion, if you use the list option in the stats command you probably have too many values, so try values instead list,

try something like this:

index blah blah
| eval msgTxt=substr(msgTxt, 1, 141) 
| stats 
     vaues(_time) as DateTime 
     values(msgTxt) as Message 
     values(polNbr) as QuoteId 
     BY tranId
| eval DateTime=strftime(DateTime , "%m-%d-%Y %I:%M:%S %p")
| streamstats count as log by tranId
| eval tranId=if(log=1,tranId,"")
| fields - log

Ciao.

Giuseppe

[gcusello]

Hi @msarkaus ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉