Transaction

[rmathur3]

how can i define a transaction end based an extracted value? the value of terminal during the transaction start should be same as transaction end. 43699 in below case
for example :
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:37] Port Msg In: Port# 18, String B1, Length 2
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B20 CBA_3DES, Length 254
[21:43:40] Port Msg In: Port# 18, String
¯!SÈ, Length 5
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:44] Port Msg In: Port# 18, String A00CBA_3DES , Length 19
[21:43:44] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:45] 120234187Push Sale 43699 Sale ID 11903, RawItems 6162, RawItems 18
[21:43:45] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:45] Create PCEFTPOS thread and send Msg, Terminal:43701
[21:43:45] W_SBuffer 43699 | 0 0 0 | 11903 1 1
[21:43:45] 120234296Send sale delete 43699 Sale ID 11903, Items 18
[21:43:45] W_Sales 43699 11903 | 24
[21:43:45] 120234531 Cleared sale buffer, Terminal 43699
[21:43:46] Sale:11903 Time:21:43,2019-05-11 Terminal:43699 Clerk:32681 ($23.00)

[betchim_gerwili]

Would you be able to extract the field using the splunk field extractor? I've used that for several things and have usually had good results from it.

[jodyfsu]

As long as the "terminal" is extracted and in each event it should work. But I do not see the "terminal" in the first line.
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19

I may be misunderstanding the issue.

[rmathur3]

thats right. so ideally the combination of first two lines should define the transaction start. and thelast line with same terminal number should be used as transaction end. after which i want to calculate the duration.

[adonio]

what is the desired output / outcome of the search?
what is it that you are after?

[rmathur3]

From the whole big log, i want below to be treated as one transaction. i want to calculate the transaction duration against the terminal number
21:43:37] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:37] Port Msg In: Port# 18, String B1, Length 2
[21:43:37] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B20 CBA_3DES, Length 254
[21:43:40] Port Msg In: Port# 18, String
¯!SÈ, Length 5
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:40] Port Msg In: Port# 18, String B1, Length 2
[21:43:40] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:41] Port Msg In: Port# 18, String B1, Length 2
[21:43:41] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:44] Port Msg In: Port# 18, String A00CBA_3DES , Length 19
[21:43:44] Create PCEFTPOS thread and send Msg, Terminal:43699
[21:43:45] 120234187Push Sale 43699 Sale ID 11903, RawItems 6162, RawItems 18
[21:43:45] Port Msg In: Port# 18, String W00CBA_3DES , Length 19
[21:43:45] Create PCEFTPOS thread and send Msg, Terminal:43701
[21:43:45] W_SBuffer 43699 | 0 0 0 | 11903 1 1
[21:43:45] 120234296Send sale delete 43699 Sale ID 11903, Items 18
[21:43:45] W_Sales 43699 11903 | 24
[21:43:45] 120234531 Cleared sale buffer, Terminal 43699
[21:43:46] Sale:11903 Time:21:43,2019-05-11 Terminal:43699 Clerk:32681 ($23.00)