Splunk Search

Using Transaction Command more than once in the query

vickyvishwa
Explorer

My Query -

index=abcd sourcetype=applog  OR (sourcetype=nginx AND uri=/v1/abcd)
| transaction startswith="status=201" endswith="className=SYSTEM resourceName=/event/v1/util" |  rename duration as stageTime1
| transaction startswith="className=SYSTEM resourceName=/event/v1/util" endswith="className=secondClass (start MyEventProducer)" |  rename duration as stageTime2
| timechart span=1h avg(stageTime1), avg(stageTime2)

The above query gives result if i run single transaction command at a time. But when I run it together (Like How i mentioned above) its giving emptuy result. Is it not possible to calculate duration for separate stages in a single query ?

0 Karma

HiroshiSatoh
Champion

Is n’t it zero?
I think the second transaction doesn't return a value because there is no keyword in _raw.

Is it all right to be grouped like this in the first place? stageTime1 is multi-field.

KEY,stageTime1
A1,10
A2,20
A3,10
B1,10
B2,20
B3,30

KEY,stageTime1,stageTime2
A,10,100
  20
  10
B,10,500
  20
  30

If there is no parent-child relationship between two transactions, how about calculating and merging them separately?

(your search transaction1)|  rename duration as stageTime1
|timechart span=1h avg(stageTime1) as stageTime1
|append [search (your search transaction2)|  rename duration as stageTime2
|timechart span=1h avg(stageTime2) as stageTime2]
|stats latest(*) as * by _time
0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...