Splunk Search

Search in transactions help

cboillot
Contributor

We have several log entries with what boils down to a transaction ID. I want to group these entries and within those groups, I want to create an alert that will trigger if a phrase shows up 10 or more times in 5 min. Below is what I currently have, but I don't think I am headed in the right direction.

 

index=index_name host=server_name sourcetype=moveit:fti*
| transaction tasknumer maxspan=300s
| search "could not get id"

Labels (1)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

Is there a reason why you're using transaction? why not just look for the "could not get id" and simply do a stats count over the last 5 min?

 

index=index_name host=server_name sourcetype=moveit:fti* "could not get id"
| stats count 

 

If you can, post some more details regarding your raw data.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

cboillot
Contributor

i may be able to use 

| stats count by tasknumer

 

I think that might be the answer.... 

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Yes, if you have multiple messages “could not get id” per task number you should use the “by tasknumber” clause.

and yes most of the times stats is the answer, not transaction. There are several presentations from .conf regarding using stats instead of transaction.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

cboillot
Contributor

In the cause, each transaction would be a different job. Each job can have a have a few "could not get id" . so we need to know per job/transaction.  We can have several jobs running at once.

 

Raw data has has date time, task number, and system message, in that order.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...