Splunk Search

Long-winded expressions in transaction's startsWith

unitedmarsupial
Path Finder

Our application's log-entries are in JSON and I need to search for certain strings found in the field called message.

I have no problem finding them with a regular search:

... AND (message="Application is closing." OR message="successfully started")

However, when I try to define a transaction with the seemingly same search criteria:

...
| transaction source startsWith="message=\"Application is closing.\"" endsWith="message=\"successfully started\""

I get zero results... Am I escaping the quotes incorrectly or making some other syntax error?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma

unitedmarsupial
Path Finder

@isoutamo wrote:

have you tried this?


Sorry, I don't see, how it would help me -- my problem is not, that only a substring is matched... Our log-entries are structured (JSON) and, consequently, the search-string contains quotes of its own.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you post sample events (scrambled)?

0 Karma

unitedmarsupial
Path Finder

Here is the sample:

12/21/21
7:43:43.000 PM
{
   logger: connectivity.runner.Runner
   message: Managed service successfully started
   severity: INFO
   thread: main
   time: 1640133823.948

}
 
  • host = rt22a10031pv00
  • source = PROD
  • sourcetype = log4j2
12/21/21
7:42:02.000 PM
{
   logger: connectivity.core.shutdown.GracefulShutdownStrategy
   message: Application is closing. Running commands will end with partial results.
   severity: WARN
   thread: Thread-6
   time: 1640133722.085

}
 
  • host =rt22a10031pv00
  • source = PROD
  • sourcetype = log4j2
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...