Splunk Search

Splunk aggregate transaction.

vanaepi
Explorer

My current situation is the following:

There are 26 messages that can be sent between three parties. There are 3 possible scenario's. Either the first 10 messages get sent, the first 18 messages get sent or all 26 messages get sent. Unless an error occurs somewhere down the road which ends the message flow.

Every message is logged and has a unique MessageID and a ProjectID. The ProjectID is unique for that specific flow of messages. An error message is also logged but has no ProjectID, in stead it logs the MessageID where the error occured.

Now, I've managed to group those messages in a transaction with ProjectID. No problems there. My issue is that I want to incorporate the error message in the transaction but adding the MessageID like this | transaction ProjectId, MessageID does not work.

How would I go about doing this?

Tags (2)
0 Karma
1 Solution

BobM
Builder

I think the problem is the order that you do the transactions. If you join by the ProjectID first, you have an event with many MessageID's that you are trying to match to an event with one. So try joining on MessageID first then in a separate transaction on ProjectID.

... | transaction MessageID | transaction ProjectID

View solution in original post

BobM
Builder

I think the problem is the order that you do the transactions. If you join by the ProjectID first, you have an event with many MessageID's that you are trying to match to an event with one. So try joining on MessageID first then in a separate transaction on ProjectID.

... | transaction MessageID | transaction ProjectID

vanaepi
Explorer

Works like a charm, thanks !

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...