My log file is similar to below and search is
I0530 14:28:10.394402 29432 tafc_logger_c.cpp:42] demoprogram.b:9 [manoj] [MYCOMP] [DEMO] End Transaction - End Message
...
...
I0530 14:28:06.406689 29432 tafc_logger_c.cpp:42] demoprogram.b:2 [manoj] [MYCOMP] [DEMO] Start Transaction - Some Message
Now I have two question
1. How to convert this log information in to table?
Table format should be like this
from above log I want to calculate time difference
Transaction Time = 0530 14:28:10.394402 - 0530 14:28:06.406689
Thanks
Below query solve my problem
earliest=06/06/2012:15:30:00 "START TRANSACTION" OR "STOP TRANSACTION" | table _time | streamstats range(_time)
Below query solve my problem
earliest=06/06/2012:15:30:00 "START TRANSACTION" OR "STOP TRANSACTION" | table _time | streamstats range(_time)
no nothing extracted
Are the fields (User, Component, Message) already extracted?
Does Splunk parse your timestamps correctly?
If yes, this is simple
/k
1 - make sure that the timestamp is correctly extracted in splunk at index time
see how to define a sourcetype http://docs.splunk.com/Documentation/Splunk/4.3.2/Data/Configuretimestamprecognition
it will be stored on the field _time.
2 - at search time, extract the other fields, using regex, inline extraction or automatic extractions.
see http://docs.splunk.com/Documentation/Splunk/4.3.2/Knowledge/Addfieldsatsearchtime
example of inline extraction
mysearch | rex "[(?
3 - define a transaction to group your events and calculate duration.
example http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Transaction
mysearch | rex "[(<?field1>\w+)] [(<?field2>\w+)] [(<?field3>\w+)]" | transaction field1 field2 field3 | table _time duration field1 field2 field3
Beware an unfinished transaction will not have a valid duration.
Regards
Try to follow the instructions provided by yannk. That's pretty much how it's done.
/k
I am forwarding data from universal forwarder and everything is default