Splunk Search

How to generate a search for my sample data?

prashanthberam
Explorer

i have logs like this for each req.....

2016-11-09 12:57:18,855  CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696 , GroupNumber =000142003, ServiceLinecount=xx,  SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xxx, TransactionCode=REQ 

2016-11-09 12:57:18,855  CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696, GroupNumber =000142003, ServiceLineCount=xxx,  SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xxx, TransactionCode=Ack, OutCome= Success , Message text=xxxx

2016-11-09 12:57:18,855 CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696, GroupNumber =000142003, ServiceLineCount=xxx,  SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xx, TransactionCode=Response ,UtilizationAmount=xxx.

In each message up to vendor code everything is similar ..
i need a table with all the details information along with how much time it has taken between req,ACK and ACK,RSP in single table...so that later on i want to build the summary index with those search.....
is anyone help in this could appreciate that...!! thanks in advance...

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try (assuming CorrelationID is the primary key. If there are additional fields that differentiate uniq transaction, add them to stats)

your base search | fields _time CorrelationID DCN TransactionTimestamp GroupNumber ServiceLineCount SectionNumber CorporateEntityCode ClaimType VendorName VendorCode TransactionCode OutCome Message_Text UtilizationAmount | eval ReqTime=if(TransactionCode="REQ",_time,null()) | eval AckTime=if(TransactionCode="Ack",_time,null()) | eval RespTime=if(TransactionCode="Response",_time,null()) | stats values(*) as * by CorrelationID | eval DurationReq_Ack=AckTime-ReqTime | eval DurationAck_Resp = RespTime-AckTime

View solution in original post

somesoni2
Revered Legend

Give this a try (assuming CorrelationID is the primary key. If there are additional fields that differentiate uniq transaction, add them to stats)

your base search | fields _time CorrelationID DCN TransactionTimestamp GroupNumber ServiceLineCount SectionNumber CorporateEntityCode ClaimType VendorName VendorCode TransactionCode OutCome Message_Text UtilizationAmount | eval ReqTime=if(TransactionCode="REQ",_time,null()) | eval AckTime=if(TransactionCode="Ack",_time,null()) | eval RespTime=if(TransactionCode="Response",_time,null()) | stats values(*) as * by CorrelationID | eval DurationReq_Ack=AckTime-ReqTime | eval DurationAck_Resp = RespTime-AckTime

prashanthberam
Explorer

thanks...it's working...can i make it as a summary report....

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...