Solved: How to search for all events for a transaction if ... - Page 2

prashanthberam · ‎12-15-2016

Hi everybody ...
i have these kind of logs in my environment. every transaction has these 4 log messages but there is no unique id for every transaction. simply it's generating this kind of message, but there is no information to correlate this information for 1 particular transaction. but i need to find the INFORMATION whatever in between inbound and outbound. can anyone help me in that?

Thanks in advance.![alt text][1]

somesoni2 · ‎12-15-2016

Give this a try. This should group relevant transaction events together.

Your base search | eval transfield=if(searchmatch("Outbound Message"),1,0) | accum transfield | transaction transfield

If you're looking for specific output, please provide a sample/details of that.

View solution in original post

How to search for all events for a transaction if there is no unique ID?

Announcing Scheduled Export GA for Dashboard Studio

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!