Splunk Search

Transaction

ncbshiva
Communicator

Hi

This is my search query
source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry".

Now i want to evaluate count of "Errors" word from the above result.

Please help me..........

Tags (1)
0 Karma
1 Solution

ChhayaV
Communicator

hi,
Append search Errors to your query

source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry" | search Errors | stats count

hope this helps

View solution in original post

ncbshiva
Communicator

This is the sample log

[M2E-CSI]2013-06-11 01:19:40,924 PDT - Hydra is starting Control Channel
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable

0 Karma

ChhayaV
Communicator

hi,
Append search Errors to your query

source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry" | search Errors | stats count

hope this helps

ChhayaV
Communicator

hi,
if you will not use transaction simply right
source="-----.log" Error |stats count

you will get count as 5

0 Karma

ncbshiva
Communicator

Example i should get the count of "Error" word as 5

0 Karma

ncbshiva
Communicator

Please see the sample log and help me to get the count of "Error"

0 Karma

ncbshiva
Communicator

I am not getting proper count ........

0 Karma

linu1988
Champion

Please provide sample log.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...