Splunk Search

is it possible to get the sum of a multivalued field within a transaction without a unique id??

vijai_thomas
Engager

Hi,
I want to count the number or errors within two keywords say starttran and endtran.
My log data would be like

  • starttran
  • tran Id:1000
  • error*
  • abc done
  • error*
  • endtran

My query : sourcetype="abc" | eval haserror=if(searchmatch("error"),1,0) | transaction startswith=starttran endswith=endtran mvlist=haserror | table haserror TRANID

O/P

  • haserror / TRANID
  • 0
  • 0 / 1000
  • 1
  • 0
  • 1
  • 0

But i want it like

  • haserror / TRANID
  • 2 / 1000

I tried using sum(haserror) by TRANID but din't. Kindly help . Also here can't TRANID be used as unique ID ?

Thanks a lot

Tags (2)
0 Karma
1 Solution

lguinn2
Legend
sourcetype="abc" 
| eval haserror=if(searchmatch("error"),1,0) 
| transaction startswith=starttran endswith=endtran mvlist=haserror 
| eval ErrorCount = mvcount(mvfilter(haserror==1))
| table ErrorCount TRANID

should work

View solution in original post

lguinn2
Legend
sourcetype="abc" 
| eval haserror=if(searchmatch("error"),1,0) 
| transaction startswith=starttran endswith=endtran mvlist=haserror 
| eval ErrorCount = mvcount(mvfilter(haserror==1))
| table ErrorCount TRANID

should work

vijai_thomas
Engager

This worked .. Thanks a lot 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...