How do you create a transaction out of a 500 error?

[thompsonsgg]

Hi,
I want to create a single transaction out of a 500 error and a specific type of error thrown immediately after the 500. I have extracted the HTTP status using a regex, but I am unsure of how to specify the 500 error in the transaction. Trying to use just the service and "500" in the starts with command is still giving me 200 status transactions.

index= 
| rex field=message ".*http.*\-\s\[.*\]\s(?[0-9\.]*)\s(?[A-Z]*)\s(?/ots[^\s]*)\s(?[\d]{3})\s(?[^\s]*).*|ErrorCode=\"(?[^\"]+).*?ErrorDescription=\"(?[^\"]+)"
| transaction startswith="ots_*Service 500" endswith="ErrorDescription"

[kmorris_splunk]

You can limit the set of events using the base search (the part before the first |). Also, the way transaction works is, it takes a field or fields as arguments to identify all events where those fields match. For example, you may want to group all of the events with the same IP Address, into a single transaction. It will need a common value in order to associate them. The startswith and endswith would be used when there are different events that are happening in a sequence, like, a login, some other stuff happens, then a logout. Another example would be parts of a transaction that could even span different event sources.

Is there a common thread between the 500 error and the error that follows it? I'm guessing IP or host or something?

[cmerriman]

try using eval in the startswith.

startswith=eval(ErrorCode=500)