- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: transaction query providing wrong log events i...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi team,
I have two log events as mentioned below, i am trying to find out response time difference based on timestamp in both events
duration using unique trace.
|rex field=_raw "(?[\w+,\w+,\w+])" | transaction trace startswith="Security gate check " endswith="found valid consumer for Identity" | stats avg(duration) as Average_response_Time
Here i am using trace in transaction. My question is in both log events trace should be same, but here it is not picking like that.
output log events
1st one :
2019-12-05 08:03:25.348 INFO [price:promotion:rrt-0c8dfd466053d7c3c-b-de-18025-17252943-6,4c5c49909b36f6f3,4c5c49909b36f6f3] 23 xxxxx : Security gate check : requestURI : /promotions/async : HttpMethod : POST
2019-12-05 08:03:26.965 INFO [price:promotion:rrt-0c8dfd466053d7c3c-b-de-18025-17252943-6,4c5c49909b36f6f3,4c5c49909b36f6f3] 23 --- : MSG=found valid consumer for Identity
Wrong output event :
2019-12-05 05:56:43.143 INFO [demo-23-01,bcc040a4340dd02e,bcc040a4340dd02e] 23 --- [qtp700631078-191] c.t.a.p.a.s.u.SecurityContextRepository : Security gate check : requestURI : /promotions/async : HttpMethod : POST
2019-12-05 05:57:36.967 INFO [testTraceId,a4d364b8545e7228,4d099a62c112f025] 23 --- : MSG=found valid consumer for Identity
in transaction why log events are not picking based on trace. Kindly suggest any changes required in my query.
Regards,
Vinay
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you really need to use transaction? Wouldn't something like this do ?
| stats min(eval(if(match(_raw, "Security gate check"), _time, null()))) as start, max(eval(if(match(_raw, "found valid consumer for Identity"), _time, null()))) as end by trace
| eval duration = end-start
| stats avg(duration) as Average_Response_Time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi team,
I am looking for in the given splunk query, if start event is available and end event is not avaialble it should not pick the wrong event as a end event. In such cases it should not consider it as a successful transaction, i would like to showcase it as a failed transaction or incomplete transaction.
How can we achieve the expected result, kindly suggest on the same.
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
Welcome to the Splunk Community!
