Splunk Search

Splunk aggregate transaction.

vanaepi
Explorer

My current situation is the following:

There are 26 messages that can be sent between three parties. There are 3 possible scenario's. Either the first 10 messages get sent, the first 18 messages get sent or all 26 messages get sent. Unless an error occurs somewhere down the road which ends the message flow.

Every message is logged and has a unique MessageID and a ProjectID. The ProjectID is unique for that specific flow of messages. An error message is also logged but has no ProjectID, in stead it logs the MessageID where the error occured.

Now, I've managed to group those messages in a transaction with ProjectID. No problems there. My issue is that I want to incorporate the error message in the transaction but adding the MessageID like this | transaction ProjectId, MessageID does not work.

How would I go about doing this?

Tags (2)
0 Karma
1 Solution

BobM
Builder

I think the problem is the order that you do the transactions. If you join by the ProjectID first, you have an event with many MessageID's that you are trying to match to an event with one. So try joining on MessageID first then in a separate transaction on ProjectID.

... | transaction MessageID | transaction ProjectID

View solution in original post

BobM
Builder

I think the problem is the order that you do the transactions. If you join by the ProjectID first, you have an event with many MessageID's that you are trying to match to an event with one. So try joining on MessageID first then in a separate transaction on ProjectID.

... | transaction MessageID | transaction ProjectID

vanaepi
Explorer

Works like a charm, thanks !

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...