I encounter with strange issue when i use transaction and at the end sort by duration it show highest duration is 15000 but when i remove transaction it show 17000 as highest duration!!!
FYI1:correct value is 17000 and there is no special filter exist here!
FYI2:duration directly print in log i just use transaction to aggregate two lines.
Here is with transaction command:
| rex "actionName.*\.(?\w+\.\w+)\]" | rex "duration\[(?\d+)" | rex "transactionId\[(?\w+-\w+-\w+-\w+-\w+)" |transaction transactionId | sort - duration | table duration actionName username
Here is without transaction:
| rex "actionName.*\.(?\w+\.\w+)\]" | rex "duration\[(?\d+)" | rex "transactionId\[(?\w+-\w+-\w+-\w+-\w+)" | sort - duration | table duration actionName username
Here is the log:
2022-05-30 12:39:34,262 INFO [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] parameters[] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] username[ABC] startTime[1653898174262]
2022-05-30 12:42:26,109 INFO [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] duration[171847] status[done]
any idea?
Thanks
duration is a field that is (also) generated by the transaction command so the value you are extracting from the event (with rex) is getting overridden by the transaction command - try a different field name - even capitalising might work
| rex "actionName\[(\w+\.)*\.(?<actionName>\w+\.\w+)\]" | rex "duration\[(?<Duration>\d+)" | rex "transactionId\[(?<transactionId>\w+-\w+-\w+-\w+-\w+)" | transaction transactionId | sort - Duration | table Duration actionName username
duration is a field that is (also) generated by the transaction command so the value you are extracting from the event (with rex) is getting overridden by the transaction command - try a different field name - even capitalising might work
| rex "actionName\[(\w+\.)*\.(?<actionName>\w+\.\w+)\]" | rex "duration\[(?<Duration>\d+)" | rex "transactionId\[(?<transactionId>\w+-\w+-\w+-\w+-\w+)" | transaction transactionId | sort - Duration | table Duration actionName username