Splunk Search

transaction or join where the search field changes but another field is common

stewartevans
Explorer

Hi I have a log with entries similar to below

11:32:12,988 INFO [LOG TYPE: REQUEST] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...
11:32:14,364 SEVERE [LOG TYPE:EXCEPTION] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...
11:32:14,364 INFO [LOG TYPE:RESPONSE] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...

What I'm looking for is a search which displays all 3 which have the same REQUEST ID if it finds a SEVERE or LOG TYPE:EXCEPTION

Transaction almost sounds like what I want so I tried the following

sourcetype=cas SEVERE | transaction RequestId maxspan=5s maxpause=5s

However this only brings back the SEVERE entry.

Is there a way to do this with transaction or should I be looking at JOIN?

Thanks for your assistance

Tags (3)
1 Solution

acharlieh
Influencer

Comment for now as I'm half asleep spinning a theory:

One thought is search for all records with a RequestId, do the transaction, and then use either a search or where command to filter the results to only include those. e.g.

sourcetype=cas RequestId=* | transaction RequestId ...   | search SEVERE

View solution in original post

acharlieh
Influencer

Comment for now as I'm half asleep spinning a theory:

One thought is search for all records with a RequestId, do the transaction, and then use either a search or where command to filter the results to only include those. e.g.

sourcetype=cas RequestId=* | transaction RequestId ...   | search SEVERE

stewartevans
Explorer

acharlieh you are a genius! It works!!

acharlieh
Influencer

Well excellent then! converted comment to an answer.

0 Karma

stewartevans
Explorer

Cheers, thanks for such a quick response

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...