Splunk Search

Issue in transaction command

Explorer

Hi Team,

 

I have few connections regarding transaction command. I have a series of events. One of the events are mentioned below.

1st event-RAUPPT_PT280916DC0101...sm_mr=PT280916DC0101

2nd event- LLAPTU_PT280916DC0101

Questions-

1. Here I want to use transaction command based on PT280916DC010 pattern. Can someone please provide me regex to extract this. PT* will be fixed for every event.

2. As PT280916DC0101 is used in multiple times on 1st event. Will it create any problems ?

 

Labels (4)
Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Is it necessary? if you don't extract it, transaction can be done.

0 Karma

Explorer

@to4kawa ..Yes actually I want to perform some other operations on id once it is extracted runtime.

How can we extract it at run time ?

0 Karma

Explorer

@to4kawa I am able to extract the field id with rex field= _raw "..."

 

But when I am running transaction command on id..there is no statistics coming except events

0 Karma

SplunkTrust
SplunkTrust
0 Karma

Explorer

@to4kawa ...strangely it is not producing statistics but when I am using table =* at the end I could see the results.

0 Karma

SplunkTrust
SplunkTrust

1:
| rex "_(?<id>PT\d+[A-Z]{2}\d{4})"
2: no

sample:

index=_internal | head 1 | fields _time _raw | eval _raw="RAUPPT_PT280916DC0101...sm_mr=PT280916DC0101"
| appendpipe [ eval _raw="LLAPTU_PT280916DC0101"]
| rex "_(?<id>PT\d+[A-Z]{2}\d{4})"
0 Karma

Explorer

@to4kawa I am unable to extract field PT280916DC0101 with | rex "_(?<id>PT\d+[A-Z]{2}\d{4})"

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!