Splunk Search

How do I group events by field (trans ID) and count as a single event?

sglazier
New Member

My apologies is this has been asked and answered.

We have logs that record several error entries for a single transaction. We have mapped the transaction ID as a field and would like to group all of the log entries for a particular transaction together to be counted as a single event. Would this be best done as the logs are consumed by Splunk or when searching and how would I go about doing it?

Thanks

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What do you mean by "counted as a single event"?

0 Karma

woodcock
Esteemed Legend

It is best definitely to do at Search Time ("while searching") and you can use the transaction command but if the events are time-sequenced already, this will be MUCH more efficient:

... | stats list(_raw) AS events BY transactionID
0 Karma