Splunk Search

Search in transactions help

cboillot
Communicator

We have several log entries with what boils down to a transaction ID. I want to group these entries and within those groups, I want to create an alert that will trigger if a phrase shows up 10 or more times in 5 min. Below is what I currently have, but I don't think I am headed in the right direction.

 

index=index_name host=server_name sourcetype=moveit:fti*
| transaction tasknumer maxspan=300s
| search "could not get id"

Labels (1)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

Is there a reason why you're using transaction? why not just look for the "could not get id" and simply do a stats count over the last 5 min?

 

index=index_name host=server_name sourcetype=moveit:fti* "could not get id"
| stats count 

 

If you can, post some more details regarding your raw data.

------------
Hope I was able to help you. If so, an upvote would be appreciated.
0 Karma

cboillot
Communicator

i may be able to use 

| stats count by tasknumer

 

I think that might be the answer.... 

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Yes, if you have multiple messages “could not get id” per task number you should use the “by tasknumber” clause.

and yes most of the times stats is the answer, not transaction. There are several presentations from .conf regarding using stats instead of transaction.

------------
Hope I was able to help you. If so, an upvote would be appreciated.
0 Karma

cboillot
Communicator

In the cause, each transaction would be a different job. Each job can have a have a few "could not get id" . so we need to know per job/transaction.  We can have several jobs running at once.

 

Raw data has has date time, task number, and system message, in that order.

0 Karma