Splunk Search

How to avaiod multiple results while using transaction command?

karthi2809
Builder

Hi Guys,

Thanks in Advance.

I am using transaction command to fetch unique correlationId and i have multiple conditions to be match.below is my query .I am getting result.But not in proper way

 

 

 

index="mulesoft"     (message="API: START: /v1/fin_outbound") OR
(message="API: START: /v1/onDemand") OR (message="API: START: /v1/fin_Import") OR (message="API: START: /v1/onDemand") OR (*End of GL-import flow*) OR (tracePoint="EXCEPTION") OR (priority="WARN" AND *GLImport Job Already Running, Please wait for the job to complete*) OR (*End of GL Import process - No files found for import to ISG*) |transaction correlationId | search NOT message IN ("API: START: /v1/fin_Zuora_GL_Revpro_Journals_outbound")|rename content.File.fid as "TransferBatch/OnDemand" content.File.fname as "BatchName/FileName" content.File.fprocess_message as ProcessMsg content.File.fstatus as Status content.File.isg_file_batch_id as OracleBatchID content.File.total_rec_count as "Total Record Count"|eventstats min(timestamp) AS Start_Time, max(timestamp) AS End_Time by correlationId| eval JobType=case(like('message',"%API: START: /v1/onDemand%"),"OnDemand",like('message',"%API: START: /v1/onDemand%"),"OnDemand",like('message',"API: START: /v1/fin_Import"),"Scheduled")| eval Status=case(like('Status' ,"%SUCCESS%"),"SUCCESS", like('Status',"%ERROR%"),"ERROR",like('tracePoint',"%EXCEPTION%"),"ERROR",like('priority',"%WARN%"),"WARN",like('message',"%End of GL Import process - No files found for import to ISG%"),"ERROR")| eval ProcessMsg= coalesce(ProcessMsg,message)
| eval StartTime=round(strptime(Start_Time, "%Y-%m-%dT%H:%M:%S.%QZ")) 
| eval EndTime=round(strptime(End_Time, "%Y-%m-%dT%H:%M:%S.%QZ")) 
| eval ElapsedTimeInSecs=EndTime-StartTime 
| eval "Total Elapsed Time"=strftime(ElapsedTimeInSecs,"%H:%M:%S") 
|rename Logon_Time as Timestamp
 |table Status Start_Time JobType "TransferBatch/OnDemand"  "BatchName/FileName"  ProcessMsg OracleBatchID "Total Record Count" ElapsedTimeInSecs "Total Elapsed Time"  correlationId|fields - ElapsedTimeInSecs | search Status="*"

 

 

 

Screen shot added in that i want to show only yellow marked values

0 Karma

PickleRick
SplunkTrust
SplunkTrust

There is quite a lot going on here and I'm not fully sure you're getting proper results.

Anyway.

1. The "base" search is not very well done. Firstly, you're searching for separate short tokens instead of whole strings in some of those parentheses. Secondly, you use wildcards at the beginning of your search terms. It kills performance.

2. The transaction command combines values of the same field across the whole transaction. That's how it works.

3. I'd try to combine the events by stats instead of transaction of course. Transaction is best avoided if you can.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...