Hey partner
In my system, every visit consist of one or more transactions and every has its global serial number, which is unique(gsn for short). A transaction may produce many rows of logs, which ...
See more...
Hey partner
In my system, every visit consist of one or more transactions and every has its global serial number, which is unique(gsn for short). A transaction may produce many rows of logs, which is event in Splunk, but it has the same gsn. A transaction always ends with "trans end transName", while the "transName" means the name of the transaction, a transaction named Test ends with "trans end Test", for example. Every transaction's name is unique and just appear once per gsn.
I can get the transaction's name by using the command below.
rex "trans end (?<transName>\w+)"
I want to fill a common transName field for every event. For example, a transaction log 3 rows, which are treated as 3 events in Splunk. Its gsn is 10000 and its raw logs is like below:
GlobalseqNo:10000 trans end Test
GlobalseqNo:10000 log 2
GlobalseqNo:10000 log 1
When I just use the command below, the result is like the table below
rex "trans end (?<transName>\w+)"
| table gsn transName
gsn
transName
10000
Test
10000
10000
I want to fill a common transName field for every event. So when there are a lot of transactions, the command above will produce the result below
gsn
transName
10000
Test
10000
Test
10000
Test
10001
A
10001
A
10002
B
10002
B