Splunk Search

Transaction not providing all events in target range.

jlacal
Explorer

Howdy:
I'm a new Splunker so this may be a dumb question. I have looked around splunk>Answers and couldn't find a solution to my problem, So here it goes. Using Splunk Enterprise 6.1.2 on Mac OS X.

transactiontypes.conf has this definition:

[aaRegistration]
maxspan = 2h
maxpause = 2h
maxevents = 10000
unifyends = t
fields = _time, host, _raw
startswith = "::aaRegistration"
endswith = "aa"

The indexed events already loaded into Splunk look like this:
...
aaRegistration
...
... events during “aaRegistration” phase, all with datestamp
...
aaCalibration
..
.... events during “aaCalibration” phase, all with datestamp
...
aaInfo
...
... events during “aaInfo” phase
...
aaMarks
...
... events during “aaMarks” phase, all with datestamp
...

When I search with this:
host=hostA sourcetype="typeB" earliest="05/02/2014:00:00:00" latest="05/03/2014:00:00:00" | transaction name=aaRegistration

The result does show the one event that starts the transaction. But I do not get any of the events between the start and the end, just a single event.

Question: what do I need to change to be able to see a list of all events that occurred between the start and the end of the “aaRegistration” phase?

Pointers appreciated. Thanks.

0 Karma

jlacal
Explorer

Hello:
Not really answering my own question but just posting this as it may be useful to others facing the same issue.

"You have to have a common field to match on for the transaction command"
From: http://answers.splunk.com/answers/91742/grouping-of-similar-events

It looks like I may need to create a new field to use for the "transaction" to group on.
Using my example above, I may need to add a new field (let's call it "phase_name") that describes which "phase" of the program each event belongs to.

For example:
aaRegistration
...
... events during “aaRegistration” phase, all with datestamp
...
aaCalibration

I may need to add a new field where all events after
aaRegistration
have "phase_name" = "aaRegistration"

Then I may (hopefully) be able to retrieve the "aaRegistration" transaction by using the "phase_name" field.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...