Splunk Search

Search filter giving unexpected results

szimmer661
Explorer

I have the following search:

index=ironstream MFSOURCETYPE=SMF110 (SAPPLID=CSFBTP0* AND (TRAN=PA6* OR HOL* OR SMX* OR SBI* OR SAP*)) | bin _time span=15m | eval IntervalTime=strftime(_time,"%H.%M") | chart count(TRAN) as "Transaction Count" over IntervalTime by TRAN

Results are including transaction names like LGAB, MBRC and SFBC and don't include transaction names like SMXS and SMXU, for which we did have counts for the time frame selected.

Results from a similar search with the same filters, but that sums a numeric field yield closer to expected results, but include a transaction named COIE and again don't include the SMX* transactions.

I obviously don't understand something about the filtering and any help will be greatly appreciated.

Tags (3)
0 Karma
1 Solution

sundareshr
Legend

Assuming the field TRAN has been extracted. try this

index=ironstream MFSOURCETYPE=SMF110 (SAPPLID=CSFBTP0* AND (TRAN=PA6* OR TRAN=HOL* OR TRAN=SMX* OR TRAN=SBI* OR TRAN=SAP*)) | bin _time span=15m | eval IntervalTime=strftime(_time,"%H.%M") | chart count(TRAN) as "Transaction Count" over IntervalTime by TRAN

View solution in original post

0 Karma

sundareshr
Legend

Assuming the field TRAN has been extracted. try this

index=ironstream MFSOURCETYPE=SMF110 (SAPPLID=CSFBTP0* AND (TRAN=PA6* OR TRAN=HOL* OR TRAN=SMX* OR TRAN=SBI* OR TRAN=SAP*)) | bin _time span=15m | eval IntervalTime=strftime(_time,"%H.%M") | chart count(TRAN) as "Transaction Count" over IntervalTime by TRAN
0 Karma

szimmer661
Explorer

That worked perfectly. Thanks for the help and the prompt reply.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...