Search in transactions help

[cboillot]

We have several log entries with what boils down to a transaction ID. I want to group these entries and within those groups, I want to create an alert that will trigger if a phrase shows up 10 or more times in 5 min. Below is what I currently have, but I don't think I am headed in the right direction.

index=index_name host=server_name sourcetype=moveit:fti*
| transaction tasknumer maxspan=300s
| search "could not get id"

[diogofgm]

Is there a reason why you're using transaction? why not just look for the "could not get id" and simply do a stats count over the last 5 min?

index=index_name host=server_name sourcetype=moveit:fti* "could not get id"
| stats count 

If you can, post some more details regarding your raw data.

[cboillot]

i may be able to use 

| stats count by tasknumer

I think that might be the answer.... 

[diogofgm]

Yes, if you have multiple messages “could not get id” per task number you should use the “by tasknumber” clause.

and yes most of the times stats is the answer, not transaction. There are several presentations from .conf regarding using stats instead of transaction.

[cboillot]

In the cause, each transaction would be a different job. Each job can have a have a few "could not get id" . so we need to know per job/transaction.  We can have several jobs running at once.

Raw data has has date time, task number, and system message, in that order.