Splunk Search

How do I reconstruct the path of a message across multiple events?

asturt
Explorer

I have a log file from our ESB that has multiple events for each message. I want to join those back together so I can see how long the whole journey is taking, how many are not making it all the way, and so on.

I'm very new to Splunk, so I'm not at all sure how to chain those events together. Is having multiple queries of the same log chained together with the appendcols command a good approach? And, actually, even if I do that, how do I join an event from one query's result set to the matching event in the next query's result set?

0 Karma

whrg
Motivator

Do events, which belong together, have a field in common?

If so, you could use the transaction command. This will add fields together based on one or more fields.

0 Karma

asturt
Explorer

I found some documentation on selfjoin, but it's going to take me a while to figure out how to use it, and I don't know if it will do what I need.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...