Splunk Search

Issue in transaction command

ramprakash
Explorer

Hi Team,

 

I have few connections regarding transaction command. I have a series of events. One of the events are mentioned below.

1st event-RAUPPT_PT280916DC0101...sm_mr=PT280916DC0101

2nd event- LLAPTU_PT280916DC0101

Questions-

1. Here I want to use transaction command based on PT280916DC010 pattern. Can someone please provide me regex to extract this. PT* will be fixed for every event.

2. As PT280916DC0101 is used in multiple times on 1st event. Will it create any problems ?

 

Labels (4)
Tags (2)
0 Karma

to4kawa
Ultra Champion

Is it necessary? if you don't extract it, transaction can be done.

0 Karma

ramprakash
Explorer

@to4kawa ..Yes actually I want to perform some other operations on id once it is extracted runtime.

How can we extract it at run time ?

0 Karma

ramprakash
Explorer

@to4kawa I am able to extract the field id with rex field= _raw "..."

 

But when I am running transaction command on id..there is no statistics coming except events

0 Karma

to4kawa
Ultra Champion
0 Karma

ramprakash
Explorer

@to4kawa ...strangely it is not producing statistics but when I am using table =* at the end I could see the results.

0 Karma

to4kawa
Ultra Champion

1:
| rex "_(?<id>PT\d+[A-Z]{2}\d{4})"
2: no

sample:

index=_internal | head 1 | fields _time _raw | eval _raw="RAUPPT_PT280916DC0101...sm_mr=PT280916DC0101"
| appendpipe [ eval _raw="LLAPTU_PT280916DC0101"]
| rex "_(?<id>PT\d+[A-Z]{2}\d{4})"
0 Karma

ramprakash
Explorer

@to4kawa I am unable to extract field PT280916DC0101 with | rex "_(?<id>PT\d+[A-Z]{2}\d{4})"

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...