Transaction via Rex

[jasoneaton]

I have a query that I'm trying to get the amount of time a transaction takes to execute. I was selecting only a piece of the transaction but it does have a transaction id in the data.

This query returns results, "process start" OR "process end". Then i use Rex to grab the transaction id which also returns results, | rex field=_raw "Correlation Id: \[(?<correlation_id>.*)\] "

Next step add transaction to this so it correlates the whole transaction ... this is where it fails the transaction addition doesn't return any results. I'm sure something is wrong with my query. 

| transaction correlation_id _raw startswith="process start" endswith="process end"

Can you use transaction on a generated Rex result? Thanks in advance.

[gcusello · Accepted solution]

Hi @jasoneaton,

why don't you try to use stats instead transaction?

something like this:

your_search ("process start" OR "process end")
| rex field=_raw "Correlation Id: \[(?<correlation_id>.*)\] "
| stats earliest(_time) AS start latest(_time) AS end BY ID
| eval duration=end-start

About the regex, if you share a sample of your logs I can help you.

Ciao.

Giuseppe

[jasoneaton]

Thank you Giuseppe! That is very helpful and accomplishes what I am trying to do 🙂

[gcusello]

Hi @jasoneaton,

the important thing is to understand the approach different than DB approach that all of us have before using Splunk.

Happy Splunking.

Ciao and next time.

Giuseppe

P.S.: Karma Points are appreciated 😉