Splunk Search

Splunk aggregate transaction.

vanaepi
Explorer

My current situation is the following:

There are 26 messages that can be sent between three parties. There are 3 possible scenario's. Either the first 10 messages get sent, the first 18 messages get sent or all 26 messages get sent. Unless an error occurs somewhere down the road which ends the message flow.

Every message is logged and has a unique MessageID and a ProjectID. The ProjectID is unique for that specific flow of messages. An error message is also logged but has no ProjectID, in stead it logs the MessageID where the error occured.

Now, I've managed to group those messages in a transaction with ProjectID. No problems there. My issue is that I want to incorporate the error message in the transaction but adding the MessageID like this | transaction ProjectId, MessageID does not work.

How would I go about doing this?

Tags (2)
0 Karma
1 Solution

BobM
Builder

I think the problem is the order that you do the transactions. If you join by the ProjectID first, you have an event with many MessageID's that you are trying to match to an event with one. So try joining on MessageID first then in a separate transaction on ProjectID.

... | transaction MessageID | transaction ProjectID

View solution in original post

BobM
Builder

I think the problem is the order that you do the transactions. If you join by the ProjectID first, you have an event with many MessageID's that you are trying to match to an event with one. So try joining on MessageID first then in a separate transaction on ProjectID.

... | transaction MessageID | transaction ProjectID

vanaepi
Explorer

Works like a charm, thanks !

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...