Hi Everyone,
Looking for help to write search query for below requirement.
-time Result_Count total_search_time
12/6/16 10:02:04.000 AM 60 34.267
When clicking on above row the below information should display.
raw data looks like this.
Dec 06, 2016 10:02:04 AM CST INFO (TransactionSearchController.java:48) - String=[Entered Search Transaction(s)]
Dec 06, 2016 10:02:05 AM CST INFO (TransactionSearchDelegateImpl.java:45) - String=[Initiating Transaction search for Query], String=[test567]
Dec 06, 2016 10:02:05 AM CST INFO (TransactionSearchDelegateImpl.java:48) - transaction search without timeout
Dec 06, 2016 10:02:05 AM CST DEBUG (BaseJdbcLogger.java:139) - ==> Preparing: SELECT * from (SELECT DISTINCT HDR.TRAN_ID transactionId, SC.status_desc TRANSACTION_STATUS, HDR.RPT_DATE , decode
Dec 06, 2016 10:02:05 AM CST DEBUG (BaseJdbcLogger.java:139) - ==> Parameters: GPOS(String), 09/01/2015(String), 08/31/2016(String), 2(String), CTBECK1(String), LBOCH(String), 30000(Long)
Dec 06, 2016 10:02:39 AM CST DEBUG (BaseJdbcLogger.java:139) - <== Total: 60
Dec 06, 2016 10:02:39 AM CST INFO (TransactionSearchDelegateImpl.java:54) - String=[Transaction Search Results. Transactions Count Is], String=[test567], Integer=[60]
Dec 06, 2016 10:02:39 AM CST INFO (TransactionSearchDelegateImpl.java:55) - Transaction Search Query [test567] Time (in seconds) = 34.267
Could you please any one help me to write the search query?
Something like this should get you started.
... | transaction startswith="Initiating Transaction" endswith="Transaction Search Query" | rex "Integer=\[(?<Result_Count>\d+)" | rex "seconds\)\s=\s(?<total_search_time>[\d\.]+)" | table _time Result_Count total_search_time
Hi Richgalloway,
Thanks for your response, I have tried with above query but I didn't get any value under result count and total search time Colum
query:
index=ABC source="/weblogs/resolvetransactionservices.log" TransactionSearchController OR TransactionSearchDelegateImpl | transaction startswith="Initiating Transaction" endswith="Transaction Search Query" | rex "Integer=\[(?\d+)" | rex "seconds\)\s=\s(?[\d\.]+)" | table _time Result_Count total_search_time
output:
time Result_count total_search_time
09-12-2016 15:29 Blank Blank
I don't know what else to suggest.