Splunk Search

How to generate a search for my sample data?

Explorer

i have logs like this for each req.....

2016-11-09 12:57:18,855  CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696 , GroupNumber =000142003, ServiceLinecount=xx,  SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xxx, TransactionCode=REQ 

2016-11-09 12:57:18,855  CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696, GroupNumber =000142003, ServiceLineCount=xxx,  SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xxx, TransactionCode=Ack, OutCome= Success , Message text=xxxx

2016-11-09 12:57:18,855 CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696, GroupNumber =000142003, ServiceLineCount=xxx,  SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xx, TransactionCode=Response ,UtilizationAmount=xxx.

In each message up to vendor code everything is similar ..
i need a table with all the details information along with how much time it has taken between req,ACK and ACK,RSP in single table...so that later on i want to build the summary index with those search.....
is anyone help in this could appreciate that...!! thanks in advance...

0 Karma
1 Solution

Revered Legend

Give this a try (assuming CorrelationID is the primary key. If there are additional fields that differentiate uniq transaction, add them to stats)

your base search | fields _time CorrelationID DCN TransactionTimestamp GroupNumber ServiceLineCount SectionNumber CorporateEntityCode ClaimType VendorName VendorCode TransactionCode OutCome Message_Text UtilizationAmount | eval ReqTime=if(TransactionCode="REQ",_time,null()) | eval AckTime=if(TransactionCode="Ack",_time,null()) | eval RespTime=if(TransactionCode="Response",_time,null()) | stats values(*) as * by CorrelationID | eval DurationReq_Ack=AckTime-ReqTime | eval DurationAck_Resp = RespTime-AckTime

View solution in original post

Revered Legend

Give this a try (assuming CorrelationID is the primary key. If there are additional fields that differentiate uniq transaction, add them to stats)

your base search | fields _time CorrelationID DCN TransactionTimestamp GroupNumber ServiceLineCount SectionNumber CorporateEntityCode ClaimType VendorName VendorCode TransactionCode OutCome Message_Text UtilizationAmount | eval ReqTime=if(TransactionCode="REQ",_time,null()) | eval AckTime=if(TransactionCode="Ack",_time,null()) | eval RespTime=if(TransactionCode="Response",_time,null()) | stats values(*) as * by CorrelationID | eval DurationReq_Ack=AckTime-ReqTime | eval DurationAck_Resp = RespTime-AckTime

View solution in original post

Explorer

thanks...it's working...can i make it as a summary report....

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!