Splunk Search

Search filter giving unexpected results

szimmer661
Explorer

I have the following search:

index=ironstream MFSOURCETYPE=SMF110 (SAPPLID=CSFBTP0* AND (TRAN=PA6* OR HOL* OR SMX* OR SBI* OR SAP*)) | bin _time span=15m | eval IntervalTime=strftime(_time,"%H.%M") | chart count(TRAN) as "Transaction Count" over IntervalTime by TRAN

Results are including transaction names like LGAB, MBRC and SFBC and don't include transaction names like SMXS and SMXU, for which we did have counts for the time frame selected.

Results from a similar search with the same filters, but that sums a numeric field yield closer to expected results, but include a transaction named COIE and again don't include the SMX* transactions.

I obviously don't understand something about the filtering and any help will be greatly appreciated.

Tags (3)
0 Karma
1 Solution

sundareshr
Legend

Assuming the field TRAN has been extracted. try this

index=ironstream MFSOURCETYPE=SMF110 (SAPPLID=CSFBTP0* AND (TRAN=PA6* OR TRAN=HOL* OR TRAN=SMX* OR TRAN=SBI* OR TRAN=SAP*)) | bin _time span=15m | eval IntervalTime=strftime(_time,"%H.%M") | chart count(TRAN) as "Transaction Count" over IntervalTime by TRAN

View solution in original post

0 Karma

sundareshr
Legend

Assuming the field TRAN has been extracted. try this

index=ironstream MFSOURCETYPE=SMF110 (SAPPLID=CSFBTP0* AND (TRAN=PA6* OR TRAN=HOL* OR TRAN=SMX* OR TRAN=SBI* OR TRAN=SAP*)) | bin _time span=15m | eval IntervalTime=strftime(_time,"%H.%M") | chart count(TRAN) as "Transaction Count" over IntervalTime by TRAN
0 Karma

szimmer661
Explorer

That worked perfectly. Thanks for the help and the prompt reply.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...