sum fields with same name on transaction

[schose]

Hi community,

I've some kind of webserver log. i want to get the traffic per transaction.. so far I'm getting the whole transaction with
search index="myindex" | transaction user
one event looks good like:

user login.html ...

page1.html size=100kb ...

pageN.html size=200kb ...

logoff.html

now i need to have sum for all "size" of a transaction. Is this possible? Do i have to write a pre-parsing script which may insert some kind of transaction id into the logfile before indexing it? Is there some kind of transactionid created when using "transaction"?

Thanks for you help in advance!

Andreas

[dmaislin_splunk]

This should get you going. I didn't have a user value other than - so I used clientip and renamed by bytes field to size so you can just ignore that part of my search. Transaction let's you take any given field that and push all the different event lines into a single event. It also creates a duration field and has many other options. Here are a few ways to get you going:

sourcetype=access_combined | rename bytes as size | rename clientip as user | eventstats sum(size) as subTotal by user | transaction user | table user size subTotal | streamstats sum(subTotal) as SubTotalSoFar

sourcetype=access_combined | rename bytes as size | rename clientip as user | transaction user | stats  sum(size) as subTotal by user

You may not really need transaction at all since it is expensive to use and just do this:

sourcetype=access_combined | rename bytes as size | rename clientip as user | stats  sum(size) as subTotal by user

I hope this gets you going.

[somesoni2 · Accepted solution]

There is field called _cd created by transaction command which can uniquely identify each transactions. I am assuming you already have a field (multivalued) which holds the size value in numeric form (if not add eval statements before transaction to do that), then you can use something like this to get the sum of size for each identified transactions

search index="myindex" | transaction user | eventstats sum(size) as TotalSize by _cd