Splunk Search

Splunk aggregate transaction.

vanaepi
Explorer

My current situation is the following:

There are 26 messages that can be sent between three parties. There are 3 possible scenario's. Either the first 10 messages get sent, the first 18 messages get sent or all 26 messages get sent. Unless an error occurs somewhere down the road which ends the message flow.

Every message is logged and has a unique MessageID and a ProjectID. The ProjectID is unique for that specific flow of messages. An error message is also logged but has no ProjectID, in stead it logs the MessageID where the error occured.

Now, I've managed to group those messages in a transaction with ProjectID. No problems there. My issue is that I want to incorporate the error message in the transaction but adding the MessageID like this | transaction ProjectId, MessageID does not work.

How would I go about doing this?

Tags (2)
0 Karma
1 Solution

BobM
Builder

I think the problem is the order that you do the transactions. If you join by the ProjectID first, you have an event with many MessageID's that you are trying to match to an event with one. So try joining on MessageID first then in a separate transaction on ProjectID.

... | transaction MessageID | transaction ProjectID

View solution in original post

BobM
Builder

I think the problem is the order that you do the transactions. If you join by the ProjectID first, you have an event with many MessageID's that you are trying to match to an event with one. So try joining on MessageID first then in a separate transaction on ProjectID.

... | transaction MessageID | transaction ProjectID

vanaepi
Explorer

Works like a charm, thanks !

0 Karma
Get Updates on the Splunk Community!

Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...