How to build a query to find the request and response of the main service and sub services

[mprreddy51]

Hi,

I have a request and response logs for service.here is the question.
service A(main service)(id:1111):
---Internal service1(sub service)(id:1111)
---internal service 2(sub service)(id:1111)
----Internal service 3(sub service)(id:1111)
Here service A starts and creates a ID and it will execute sub services(1,2,3).Id Remains the same for main and sub services.
My requirement is:

I need to find out the time taken to complete the request and response for each and every main service. If the subservice failed then i should be able to see logs.In the events there is a success codes and failure codes.

please help with query.

[guilmxm]

Hi,

You will want to work with transaction:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

[mprreddy51]

I already did like this but not working:
Index=abc sourcetype=pqr service=moper |transaction id
but i am getting all events;

[guilmxm]

transaction is probably part of an answer, transaction will identify and group events depending on fields with values common to events, such as a session id. (which is your use)

But that's part of the job, you will next want to evaluate the response time per sub_service / id, it's hard to answer really without being in the data, but if you have field extracted, the sub service name and the id, some simple evaluation like (even without transaction)

| stats avg(myfield) by subservice_fieldname, id_fieldname

Should start putting you on the right way.

The stats command will automatically associate the id with sub_service if your fields are correctly extracted.
As said earlier, transaction will be useful to group events, its add valuable fields (look at the doc) you may need to use in your search before evaluating the response time for example.