Splunk Search

Transaction Command

splunkpoornima
Communicator

hi all

i have taskmanager log files which has the events like

Mon Jun 25 00:00:30 CDT 2012,DistributedEvaluation,START

Mon Jun 25 00:00:30 CDT 2012,DistributedEvaluation,COMPLETION: Succeeded

Mon Jun 25 00:05:13 CDT 2012,DealStatusUpdate,START

Mon Jun 25 00:05:13 CDT 2012,DealStatusUpdate,Status : Completed with errors

Mon Jun 25 00:05:19 CDT 2012,AccquireGlobalLock,START

Mon Jun 25 00:05:19 CDT 2012,AccquireGlobalLock,COMPLETION : Completed with errors

i used the serach query like below to find the duration for the above three tasks

source="xxx"|transaction TaskAction startswith=START endswith=COMPLETION: OR Staus :neutral_face:

thanks in advance

poornima

but it showed me oly the duration for the Task has COMPLETION: and not for the Staus :

Tags (1)
0 Karma

Ayn
Legend

I see a couple of problems in your search.

First of all your logs use the string "Status :", not "Staus :" which you seem to be using. Where the ending pipe (Status :|) comes from I don't understand at all. So, even if you were using the correct syntax for transaction (which you are not, see below) you have errors there that would cause it not to work as you want.

Most importantly, you're using the wrong syntax. You're saying "endswith=COMPLETION: OR Staus:|", which I interpret as that you want the endswith condition to cover either the string "COMPLETION:" or "Staus :". This is not how transaction interprets it. It sees the endswith=COMPLETION:, then three totally separate terms - "OR", "Staus" and ":". Terms that aren't connected to an argument are interpreted as fields that it should use when building transactions.

To match endswith on multiple strings, you need to use an eval expression instead. Based on your sample input I'd do something like:

... | transaction TaskAction startswith=START endswith=eval(match(_raw,"COMPLETION:") OR match(_raw,"Status :"))

Docs on transaction: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction

kbaden
Explorer

This was excellent!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...