How to write a search for my requirement?

[lksridhar]

Hi Everyone,

Looking for help to write search query for below requirement.

-time                              Result_Count                          total_search_time
12/6/16 10:02:04.000 AM            60                                    34.267

When clicking on above row the below information should display.

raw data looks like this.

Dec 06, 2016 10:02:04 AM CST INFO (TransactionSearchController.java:48) - String=[Entered Search Transaction(s)]
Dec 06, 2016 10:02:05 AM CST INFO (TransactionSearchDelegateImpl.java:45) - String=[Initiating Transaction search for Query], String=[test567]
Dec 06, 2016 10:02:05 AM CST INFO (TransactionSearchDelegateImpl.java:48) - transaction search without timeout
Dec 06, 2016 10:02:05 AM CST DEBUG (BaseJdbcLogger.java:139) - ==> Preparing: SELECT * from (SELECT DISTINCT HDR.TRAN_ID transactionId, SC.status_desc TRANSACTION_STATUS, HDR.RPT_DATE , decode 
Dec 06, 2016 10:02:05 AM CST DEBUG (BaseJdbcLogger.java:139) - ==> Parameters: GPOS(String), 09/01/2015(String), 08/31/2016(String), 2(String), CTBECK1(String), LBOCH(String), 30000(Long)
Dec 06, 2016 10:02:39 AM CST DEBUG (BaseJdbcLogger.java:139) - <== Total: 60
Dec 06, 2016 10:02:39 AM CST INFO (TransactionSearchDelegateImpl.java:54) - String=[Transaction Search Results. Transactions Count Is], String=[test567], Integer=[60]
Dec 06, 2016 10:02:39 AM CST INFO (TransactionSearchDelegateImpl.java:55) - Transaction Search Query [test567] Time (in seconds) = 34.267

Could you please any one help me to write the search query?

[richgalloway]

Something like this should get you started.

... | transaction startswith="Initiating Transaction" endswith="Transaction Search Query" | rex "Integer=\[(?<Result_Count>\d+)" | rex "seconds\)\s=\s(?<total_search_time>[\d\.]+)" | table _time Result_Count total_search_time

[lksridhar]

Hi Richgalloway,

Thanks for your response, I have tried with above query but I didn't get any value under result count and total search time Colum

query:

index=ABC source="/weblogs/resolvetransactionservices.log" TransactionSearchController OR TransactionSearchDelegateImpl | transaction startswith="Initiating Transaction" endswith="Transaction Search Query" | rex "Integer=\[(?\d+)" | rex "seconds\)\s=\s(?[\d\.]+)" | table _time Result_Count total_search_time

output:

time Result_count total_search_time
09-12-2016 15:29 Blank Blank

[richgalloway]

I don't know what else to suggest.