Splunk Search

Total a field in a transaction

Path Finder

I have a transaction that is tied together based on IP address in a web server log. The IP is c_ip and the search would look something like the below -

index=iis sourcetype=iis-w3c (csmethod=POST csuristem=/page1) OR (csuristem=/page2) | transaction cip maxspan=12s startswith="csmethod=POST csuristem=/pagea" endswith="csmethod=GET csuristem=/pageb" | search linecount>1 duration="1"

There is a field that exists in each log entry called timetaken. I would like to create a value called TotalTime= timetaken of PageA + time_taken of PageB of the defined transaction. How do I do this? Basically how to I get the value of a field that exists in each log entry inside a transaction when they both have the same name?


Tags (1)
0 Karma


if the values are marked as multivalue fields, you can pass them through the transaction command using the mvlist flag. After they are both listed on the transaction, you can then use streamstats to add them even-though they are the same name.

index=iis sourcetype=iis-w3c (cs_method=POST cs_uri_stem=/page1) OR (cs_uri_stem=/page2) 
| transaction c_ip maxspan=12s startswith="cs_method=POST cs_uri_stem=/pagea" endswith="cs_method=GET cs_uri_stem=/pageb"  mvlist=time_taken
| streamstats sum(time_taken) as Total_Time_Taken window=1

this would mean if page1 has time_taken=1 and page2 has time_taken=2, the resulting transaction will have 2 time_taken fields, one marked 1 and one marked 2. Streamstats will then create a new field "Total_Time_Taken" and add all occurrences of "time_taken", resulting in a value of 3.


thanks pal, this solved precisely my issue 🙂


Just to double-check: Is pageA always guaranteed to be the first event in the transaction and pageB always guaranteed to be the last?

0 Karma