Splunk Search

List events but exclude if part of transaction

bbuff1
New Member

My log has timeout events that occur on calls to UPS. There are timeout events for other reasons as well. I want my search result to only list timeout events that are not due to the UPS call. See example log below:

01/18/2019 08:20:13,554 INFO stdout 786765832 [default task-270] ERROR com.macys.mst.carrier.UPSHttpPostClient - Exception in UPS tracking service ::
01/18/2019 08:20:13,559 INFO stdout java.net.SocketTimeoutException: connect timed out
01/18/2019 08:20:13,559 INFO stdout at java.net.PlainSocketImpl.socketConnect(Native Method)

The transaction below will capture the java.net.SocketTimeoutException when the previous event has UPS in it:
..| transaction startswith="Exception in UPS tracking service" endswith="java.net.SocketTimeoutException"

However I don't want this included in my result. I want all java.net.SocketTimeoutException when they are not a result of a call to UPS.

0 Karma

dniglio
Observer

You figure out how to do this? I'd like my search results to only return events that are not a part of a specified transaction.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...