Splunk Search

How do I reconstruct the path of a message across multiple events?

asturt
Explorer

I have a log file from our ESB that has multiple events for each message. I want to join those back together so I can see how long the whole journey is taking, how many are not making it all the way, and so on.

I'm very new to Splunk, so I'm not at all sure how to chain those events together. Is having multiple queries of the same log chained together with the appendcols command a good approach? And, actually, even if I do that, how do I join an event from one query's result set to the matching event in the next query's result set?

0 Karma

whrg
Motivator

Do events, which belong together, have a field in common?

If so, you could use the transaction command. This will add fields together based on one or more fields.

0 Karma

asturt
Explorer

I found some documentation on selfjoin, but it's going to take me a while to figure out how to use it, and I don't know if it will do what I need.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...