Hello Splunk Experts: From a system, we receive following events in splunk.
I would like to get the event which doesn't have logEvent as Received but has only logEvent as Delivered.
traceId field will have same value on both Received and Delivered events.
Here in the below example, traceId=101 is such an event.
{"logEvent":"Received","traceId": "100","message":"Inbound received", "id" : "00991"}
{"logEvent":"Delivered","traceId": "100","message":"Inbound sent", "id" : "00991-0"}
{"logEvent":"Delivered","traceId": "101","message":"Inbound sent", "id" : "00992-0"}
{"logEvent":"Received","traceId": "102","message":"Inbound received","id" : "00993"}
{"logEvent":"Delivered","traceId": "102","message":"Inbound sent","id" : "00993-0"}
Are the fields already extracted?
| eventstats values(logEvent) as logEvents by traceId
| where logEvents="Delivered" AND mvcount(logEvents) = 1
Are the fields already extracted?
| eventstats values(logEvent) as logEvents by traceId
| where logEvents="Delivered" AND mvcount(logEvents) = 1