Splunk Search

Inner search for database-fetched data

biju3705
New Member

I have fetching data to Splunk from a transaction tracker table. My scenario is as given below.

Here is the example of the table data I fetch:
alt text

From the above data I need to find the count of transactions with status="Failed" and do not have any "Success" status. From the above example, I should get the result as 1, since transaction Id 1000 was successful in later stages.

Could you please advise.

0 Karma

nikita_p
Contributor

Hi,
Can you try this if it helps?

...| stats values(Transation status) AS 'Status' values(Insert date time) AS Time BY "Transaction Id" | where Status="Failed"

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @biju3705,

Can you please try this?

YOUR_SEARCH
| stats values(STATUS) as STATUS by TID
| where STATUS!="Success" AND STATUS="Failed"

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...