A splunk novice question
We have logs and the example is something like this
2016-05-05T09:05:50.610050-07:00 Correlation-Id="XYZ" category="" request body :{}
2016-05-05T09:05:51.610050-07:00 Correlation-Id="XYZ" category="" response body :{}
I want to query in such a way that I am looking for a specific text in response body (that would be something like index=abc host=myserver "ERROR") as well the request body. So that I get a consolidated list of all the correlation-Ids which I can use.
Please NOTE: The request and response are in two different log lines
Is such query possible ?
Find specific text is as simple as putting the desired text in quotes.
index=foo "bar"
will find all instance of "bar" in any event in the "foo" index.
To narrow it down to events containing either "request body" or "response body":
index=foo "bar" ("request body" OR "response body")