Hi,
I am trying to integrate into splunk a Java application that generates per session logfiles. So I have lots of independente files that have interesting lines like:
Task Param 3 2013-05-14 08:00:00 Server : farm01
... (useless lines) ...
Session Login 3 2013-05-04 08:45:22 Username: testuser, Login Status: Attempt, Session ID: Zgea*censored*, IP Address: 192.168.1.100
... ( more useless lines) ...
ObjMgr InvokeMethod 4 00003682516f22dc:0 2013-04-18 09:05:38 Begin: Service 'Web Engine Properties' invoke method: 'IsFrameless' at 15636ba6
... ( lots more of invoke method lines ) ...
How can I relate the invoke messages to the user that is doing the invoking. I do not have any field I can use to make the transaction feature work. However as the application creates a file for each of the sessions I can use the filename/source as a transaction id.
Is it possible to use the source/filename as the transaction id? Or is there a differente approach?
yes you can.
* | transaction source
and if you want to extract the session from a part of the source, use a rex extraction to generate the field
example mypath/to/my/file/sessionnumber.log
* | rex field=source "blah/(<?session>\d+)\.log" | transaction session
If you have long events, transaction is not the solution.
Can you explicit what is your goal and why you think that you needed a transaction ?
So what you're saying is that the filename can't be used after all either?
I think you need to formulate first of all what rule could be used for tying events together. After that it's just a matter of translating that to something in Splunk.
The transaction doesn't allow for over 500 lines per transaction and the files have way too many lines. They are between 5Mb and over 100Mb.