Splunk Search

sum fields with same name on transaction

schose
Builder

Hi community,

I've some kind of webserver log. i want to get the traffic per transaction.. so far I'm getting the whole transaction with
search index="myindex" | transaction user
one event looks good like:

user login.html ...

page1.html size=100kb ...

pageN.html size=200kb ...

logoff.html

now i need to have sum for all "size" of a transaction. Is this possible? Do i have to write a pre-parsing script which may insert some kind of transaction id into the logfile before indexing it? Is there some kind of transactionid created when using "transaction"?

Thanks for you help in advance!

Andreas

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

There is field called _cd created by transaction command which can uniquely identify each transactions. I am assuming you already have a field (multivalued) which holds the size value in numeric form (if not add eval statements before transaction to do that), then you can use something like this to get the sum of size for each identified transactions

search index="myindex" | transaction user | eventstats sum(size) as TotalSize by _cd

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

This should get you going. I didn't have a user value other than - so I used clientip and renamed by bytes field to size so you can just ignore that part of my search. Transaction let's you take any given field that and push all the different event lines into a single event. It also creates a duration field and has many other options. Here are a few ways to get you going:

sourcetype=access_combined | rename bytes as size | rename clientip as user | eventstats sum(size) as subTotal by user | transaction user | table user size subTotal | streamstats sum(subTotal) as SubTotalSoFar

sourcetype=access_combined | rename bytes as size | rename clientip as user | transaction user | stats  sum(size) as subTotal by user

You may not really need transaction at all since it is expensive to use and just do this:

sourcetype=access_combined | rename bytes as size | rename clientip as user | stats  sum(size) as subTotal by user

I hope this gets you going.

somesoni2
Revered Legend

There is field called _cd created by transaction command which can uniquely identify each transactions. I am assuming you already have a field (multivalued) which holds the size value in numeric form (if not add eval statements before transaction to do that), then you can use something like this to get the sum of size for each identified transactions

search index="myindex" | transaction user | eventstats sum(size) as TotalSize by _cd
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...