Splunk Search

Transaction

rmathur3
New Member

how can i define a transaction end based an extracted value? the value of terminal during the transaction start should be same as transaction end. 43699 in below case
for example :
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:37] Port Msg In: Port# 18, String B1, Length 2
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B20 CBA_3DES, Length 254
[21:43:40] Port Msg In: Port# 18, String
¯!SÈ, Length 5
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:44] Port Msg In: Port# 18, String A00CBA_3DES , Length 19
[21:43:44] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:45] 120234187Push Sale 43699 Sale ID 11903, RawItems 6162, RawItems 18
[21:43:45] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:45] Create PCEFTPOS thread and send Msg, Terminal:43701
[21:43:45] W_SBuffer 43699 | 0 0 0 | 11903 1 1
[21:43:45] 120234296Send sale delete 43699 Sale ID 11903, Items 18
[21:43:45] W_Sales 43699 11903 | 24
[21:43:45] 120234531 Cleared sale buffer, Terminal 43699
[21:43:46] Sale:11903 Time:21:43,2019-05-11 Terminal:43699 Clerk:32681 ($23.00)

Tags (1)
0 Karma

betchim_gerwili
Explorer

Would you be able to extract the field using the splunk field extractor? I've used that for several things and have usually had good results from it.

0 Karma

jodyfsu
Path Finder

As long as the "terminal" is extracted and in each event it should work. But I do not see the "terminal" in the first line.
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19

I may be misunderstanding the issue.

0 Karma

rmathur3
New Member

thats right. so ideally the combination of first two lines should define the transaction start. and thelast line with same terminal number should be used as transaction end. after which i want to calculate the duration.

0 Karma

adonio
Ultra Champion

what is the desired output / outcome of the search?
what is it that you are after?

0 Karma

rmathur3
New Member

From the whole big log, i want below to be treated as one transaction. i want to calculate the transaction duration against the terminal number
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699

[21:43:37] Port Msg In: Port# 18, String B1, Length 2
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B20 CBA_3DES, Length 254
[21:43:40] Port Msg In: Port# 18, String
¯!SÈ, Length 5
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:44] Port Msg In: Port# 18, String A00CBA_3DES , Length 19
[21:43:44] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:45] 120234187Push Sale 43699 Sale ID 11903, RawItems 6162, RawItems 18
[21:43:45] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:45] Create PCEFTPOS thread and send Msg, Terminal:43701
[21:43:45] W_SBuffer 43699 | 0 0 0 | 11903 1 1
[21:43:45] 120234296Send sale delete 43699 Sale ID 11903, Items 18
[21:43:45] W_Sales 43699 11903 | 24
[21:43:45] 120234531 Cleared sale buffer, Terminal 43699
[21:43:46] Sale:11903 Time:21:43,2019-05-11 Terminal:43699 Clerk:32681 ($23.00)

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...