Splunk Search

Why is Transaction command not working as expected?

indeed_2000
Motivator

I encounter with strange issue when i use transaction and at the end sort by duration it show highest duration is 15000 but when i remove transaction it show 17000 as highest duration!!!

FYI1:correct value is 17000 and there is no special filter exist here!

FYI2:duration directly print in log i just use transaction to aggregate two lines.

 

Here is with transaction command:

| rex "actionName.*\.(?\w+\.\w+)\]" | rex "duration\[(?\d+)" | rex "transactionId\[(?\w+-\w+-\w+-\w+-\w+)" |transaction transactionId | sort - duration | table duration actionName username

 

Here is without transaction:

| rex "actionName.*\.(?\w+\.\w+)\]" | rex "duration\[(?\d+)" | rex "transactionId\[(?\w+-\w+-\w+-\w+-\w+)" | sort - duration | table duration actionName username

 

Here is the log:
2022-05-30 12:39:34,262 INFO  [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] parameters[] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] username[ABC] startTime[1653898174262]

2022-05-30 12:42:26,109 INFO  [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] duration[171847] status[done]

 

any idea?

Thanks

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

duration is a field that is (also) generated by the transaction command so the value you are extracting from the event (with rex) is getting overridden by the transaction command - try a different field name - even capitalising might work

 |  rex "actionName\[(\w+\.)*\.(?<actionName>\w+\.\w+)\]" | rex "duration\[(?<Duration>\d+)"
 | rex "transactionId\[(?<transactionId>\w+-\w+-\w+-\w+-\w+)"
 | transaction transactionId | sort - Duration
 | table Duration actionName username

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

duration is a field that is (also) generated by the transaction command so the value you are extracting from the event (with rex) is getting overridden by the transaction command - try a different field name - even capitalising might work

 |  rex "actionName\[(\w+\.)*\.(?<actionName>\w+\.\w+)\]" | rex "duration\[(?<Duration>\d+)"
 | rex "transactionId\[(?<transactionId>\w+-\w+-\w+-\w+-\w+)"
 | transaction transactionId | sort - Duration
 | table Duration actionName username
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...