Splunk Search

How can we extract transaction id from an event and do a search to display all events having that transaction ID?

diliphg
New Member

I am fairly new to Splunk queries.

I have below mentioned logs:

INFO [HTTP-120]: 2017-08-02T18:00:03,157 - transactionID=12345 - "Internal Server Error"
INFO [HTTP-120]: 2017-08-02T18:00:02,110 - transactionID=12345 - "Foo"
INFO [HTTP-120]: 2017-08-02T18:00:01,100 - transactionID=12345 - "Bar"

INFO [HTTP-120]: 2017-08-02T18:00:03,157 - transactionID=45678 - "Success"
INFO [HTTP-120]: 2017-08-02T18:00:02,110 - transactionID=45678 - "Foo"
INFO [HTTP-120]: 2017-08-02T18:00:01,100 - transactionID=45678 - "Bar"

I need to search for events which has "Internal Server Error" then extract the transactionID and do a new search to print all the events which has that transactionID.
So my output should be
INFO [HTTP-120]: 2017-08-02T18:00:03,157 - transactionID=12345 - "Internal Server Error"
INFO [HTTP-120]: 2017-08-02T18:00:02,110 - transactionID=12345 - "Foo"
INFO [HTTP-120]: 2017-08-02T18:00:01,100 - transactionID=12345 - "Bar"

The query should not fail if there are no events. I used subquery to return transactionID for base query, but for 0 events it failed saying Comparator '=' has missing right side value.

Any help is much appreciated.

0 Karma

DalJeanis
Legend

Try this...

index=baz    [ index=baz  "Internal Server Error" transactionID=* | stats by transactionID]

The stuff in braces, because of an implicit format command, translates to...

  ( transactionID="Value1" OR  transactionID="Value2" OR ...)

If nothing comes back from the braces, it comes out as...

NOT ()

...which is valid but will return no results.

0 Karma

diliphg
New Member

Still doesn't work.

This query gives the stats "index=baz "Internal Server Error" transactionID=* | stats by transactionID".

But this whole query index=baz [search index=baz "Internal Server Error" transactionID=* | stats by transactionID] says 0 events found.

Since i am new please help if there are any silly mistakes.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...