Splunk Search

Transaction

ncbshiva
Communicator

Hi

This is my search query
source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry".

Now i want to evaluate count of "Errors" word from the above result.

Please help me..........

Tags (1)
0 Karma
1 Solution

ChhayaV
Communicator

hi,
Append search Errors to your query

source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry" | search Errors | stats count

hope this helps

View solution in original post

ncbshiva
Communicator

This is the sample log

[M2E-CSI]2013-06-11 01:19:40,924 PDT - Hydra is starting Control Channel
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable

0 Karma

ChhayaV
Communicator

hi,
Append search Errors to your query

source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry" | search Errors | stats count

hope this helps

ChhayaV
Communicator

hi,
if you will not use transaction simply right
source="-----.log" Error |stats count

you will get count as 5

0 Karma

ncbshiva
Communicator

Example i should get the count of "Error" word as 5

0 Karma

ncbshiva
Communicator

Please see the sample log and help me to get the count of "Error"

0 Karma

ncbshiva
Communicator

I am not getting proper count ........

0 Karma

linu1988
Champion

Please provide sample log.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...