Splunk Search
Highlighted

Searching by Transaction TYPE

Communicator

The following query finds what I would call "RejectedTrasnactions"

index="radius"  | transaction nps_Class maxspan=1s startswith=(eventtype=nps_accessRequested) endswith=(eventtype=nps_accessReqRejected)| timechart count by nps_callingStation

I use a similar query to find "AcceptedTrasnactions"

If opt to add appropriate code to transactions.conf, is there a way to gather stas based on transaction types? For example, would a query like this show me how many of each transaction type occurred per time period?

index="radius" |timechart count by transaction
Tags (2)
0 Karma
Highlighted

Re: Searching by Transaction TYPE

Motivator

it's actually transactiontypes.conf but it only allow to call 1 transaction definition by using "... | transaction name=mytransactiondef ..." and this "name" field doesnot seems to be searchable.

Then i would try a different way either using summary indexing & marker or eval & case function

View solution in original post

0 Karma