Splunk Search

Transaction

New Member

how can i define a transaction end based an extracted value? the value of terminal during the transaction start should be same as transaction end. 43699 in below case
for example :
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:37] Port Msg In: Port# 18, String B1, Length 2
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B20 CBA_3DES, Length 254
[21:43:40] Port Msg In: Port# 18, String
¯!SÈ, Length 5
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:44] Port Msg In: Port# 18, String A00CBA_3DES , Length 19
[21:43:44] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:45] 120234187Push Sale 43699 Sale ID 11903, RawItems 6162, RawItems 18
[21:43:45] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:45] Create PCEFTPOS thread and send Msg, Terminal:43701
[21:43:45] W_SBuffer 43699 | 0 0 0 | 11903 1 1
[21:43:45] 120234296Send sale delete 43699 Sale ID 11903, Items 18
[21:43:45] W_Sales 43699 11903 | 24
[21:43:45] 120234531 Cleared sale buffer, Terminal 43699
[21:43:46] Sale:11903 Time:21:43,2019-05-11 Terminal:43699 Clerk:32681 ($23.00)

Tags (1)
0 Karma

Would you be able to extract the field using the splunk field extractor? I've used that for several things and have usually had good results from it.

0 Karma

Path Finder

As long as the "terminal" is extracted and in each event it should work. But I do not see the "terminal" in the first line.
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19

I may be misunderstanding the issue.

0 Karma

New Member

thats right. so ideally the combination of first two lines should define the transaction start. and thelast line with same terminal number should be used as transaction end. after which i want to calculate the duration.

0 Karma

SplunkTrust
SplunkTrust

what is the desired output / outcome of the search?
what is it that you are after?

0 Karma

New Member

From the whole big log, i want below to be treated as one transaction. i want to calculate the transaction duration against the terminal number
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699

[21:43:37] Port Msg In: Port# 18, String B1, Length 2
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B20 CBA_3DES, Length 254
[21:43:40] Port Msg In: Port# 18, String
¯!SÈ, Length 5
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:44] Port Msg In: Port# 18, String A00CBA_3DES , Length 19
[21:43:44] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:45] 120234187Push Sale 43699 Sale ID 11903, RawItems 6162, RawItems 18
[21:43:45] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:45] Create PCEFTPOS thread and send Msg, Terminal:43701
[21:43:45] W_SBuffer 43699 | 0 0 0 | 11903 1 1
[21:43:45] 120234296Send sale delete 43699 Sale ID 11903, Items 18
[21:43:45] W_Sales 43699 11903 | 24
[21:43:45] 120234531 Cleared sale buffer, Terminal 43699
[21:43:46] Sale:11903 Time:21:43,2019-05-11 Terminal:43699 Clerk:32681 ($23.00)

0 Karma