...t;.*)\" bytes read (?<sftp_bytes_read>\d+)" If I wanted to see how much data was downloaded (without caring about which user) I would just do a timechart which does the trick: appname=s...
...iped them into transaction. The maxspan is 130m because the test transaction takes about 123m to complete.
(DXI OR sendMessage) 652F5692-5F3F-3434-F47B-180BA1CBDDEF | rename CORRELATIONID as msgid | transact...
...poch time format) | eval _time=actionTimeStamp | sort 0 -actionTimeStamp | transaction SID startswith=(actionId="1") endswith=(actionId="6")
I get a different number of transactions. It seems l...
Hey,
I have a question about the transaction search command.
If I am using a transaction on an event that has two timestamps in it, how can I access/use both of the timestamps after the transact...
Hi all,
Hoping someone can give some pointers how to solve this problem:
I run a transaction command on the last two weeks, which gives about 20.000 events, and for about 85 percent of e...
Im very new to splunk. Could anyone please help me with the following issue?
I am in need to collect the details about the user for the Success Login attempts.
These success login attempts e...
Hello all,
The transaction command is not correctly grouping the events in query 1). The expected result is given by query 2). In the end, I need to run the query without the user_id filter which I...
Hello, I am trying to get an event inside of a transaction to use for duration calculation. My events currently look like this (for one user): 2021-06-07 17:53:01 UserId:123 Session complete 2...
...n a transaction with ProjectID. No problems there. My issue is that I want to incorporate the error message in the transaction but adding the MessageID like this | transaction ProjectId, MessageID d...