Splunk Search

Status of a transaction using splunk transaction command

ayush-choudhary
Explorer

i am using transaction command to check the start time and end time of a transaction. 

I have used:

| transaction TxnId startswith="NEW TXN" endswith= "statusY" keeporphans=true | eval starttime=_time | eval endtime=_time+duration | eval starttime=strftime('starttime', "%Y-%m-%d %H:%M:%S.%3N") | eval endtime=strftime('endtime', "%Y-%m-%d %H:%M:%S.%3N") | table TxnId starttime endtime

I want to check if all transactions have start time and end time for the success rate. Now even if the endswith="statusY" is not there, it is calculating its end time. 

What can i do to make sure there should be no end time if the condition endswith="statusY" is not there. And if the condition of both startswith and endswith is met table should show status as success or else blank.

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ayush-choudhary,

the transaction command is a very slow and expensive command, please try a different approach:

your_search ("NEW TXN" OR "statusY")
| stats earliest(_time) AS starttime latest(_time) AS endtime BY TxnId 
| eval starttime=strftime('starttime', "%Y-%m-%d %H:%M:%S.%3N"), endtime=strftime('endtime', "%Y-%m-%d %H:%M:%S.%3N") 
| table TxnId starttime endtime

This approach is possible when you have an ID to use to group events.

Ciao.

Giuseppe

0 Karma

ayush-choudhary
Explorer

@gcusello 

thanks, but with this query as well i am getting an endtime for a TxnId for with there is no "statusY"
i am finding something with can show me no value for endtime for a TxnId that do not have "statusY".

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi, ok, please try this:

your_search ("NEW TXN" OR "statusY")
| stats earliest(_time) AS starttime latest(_time) AS endtime count BY TxnId 
| eval 
     status=case(count=2,"Both present",searchmatch("NEW TXN"),"Only NEW TXN",searchmatch("statusY"),"Only statusY"), 
     starttime=strftime('starttime', "%Y-%m-%d %H:%M:%S.%3N"), 
     endtime=strftime('endtime', "%Y-%m-%d %H:%M:%S.%3N") 
| table TxnId starttime endtime status

in this way you can identify all the conditions and take only the ones you want.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...