Splunk Search

How do I reconstruct the path of a message across multiple events?

asturt
Explorer

I have a log file from our ESB that has multiple events for each message. I want to join those back together so I can see how long the whole journey is taking, how many are not making it all the way, and so on.

I'm very new to Splunk, so I'm not at all sure how to chain those events together. Is having multiple queries of the same log chained together with the appendcols command a good approach? And, actually, even if I do that, how do I join an event from one query's result set to the matching event in the next query's result set?

0 Karma

whrg
Motivator

Do events, which belong together, have a field in common?

If so, you could use the transaction command. This will add fields together based on one or more fields.

0 Karma

asturt
Explorer

I found some documentation on selfjoin, but it's going to take me a while to figure out how to use it, and I don't know if it will do what I need.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!