Transaction Command

[splunkpoornima]

hi all

i have taskmanager log files which has the events like

Mon Jun 25 00:00:30 CDT 2012,DistributedEvaluation,START

Mon Jun 25 00:00:30 CDT 2012,DistributedEvaluation,COMPLETION: Succeeded

Mon Jun 25 00:05:13 CDT 2012,DealStatusUpdate,START

Mon Jun 25 00:05:13 CDT 2012,DealStatusUpdate,Status : Completed with errors

Mon Jun 25 00:05:19 CDT 2012,AccquireGlobalLock,START

Mon Jun 25 00:05:19 CDT 2012,AccquireGlobalLock,COMPLETION : Completed with errors

i used the serach query like below to find the duration for the above three tasks

source="xxx"|transaction TaskAction startswith=START endswith=COMPLETION: OR Staus 😐

thanks in advance

poornima

but it showed me oly the duration for the Task has COMPLETION: and not for the Staus :

[Ayn]

I see a couple of problems in your search.

First of all your logs use the string "Status :", not "Staus :" which you seem to be using. Where the ending pipe (Status :|) comes from I don't understand at all. So, even if you were using the correct syntax for transaction (which you are not, see below) you have errors there that would cause it not to work as you want.

Most importantly, you're using the wrong syntax. You're saying "endswith=COMPLETION: OR Staus:|", which I interpret as that you want the endswith condition to cover either the string "COMPLETION:" or "Staus :". This is not how transaction interprets it. It sees the endswith=COMPLETION:, then three totally separate terms - "OR", "Staus" and ":". Terms that aren't connected to an argument are interpreted as fields that it should use when building transactions.

To match endswith on multiple strings, you need to use an eval expression instead. Based on your sample input I'd do something like:

... | transaction TaskAction startswith=START endswith=eval(match(_raw,"COMPLETION:") OR match(_raw,"Status :"))

Docs on transaction: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction

[kbaden]

This was excellent!