Hi,
I need small help from you, I am calculating duration of each transaction of on userid.
My query:
index=A sourcetype=B host=ABC | rex field=_raw "-R(?.*)-I" | rex field=_raw "status\s" |transaction DID maxevents=10000 startswith="Beginning session" endswith="Ending session" | convert ctime(_time) as time |eval endtime= _time+duration |convert ctime(endtime) as Endtime| eval hour=strftime(_time, "%H")|eval status=if(result="0","Success", "Error") | table DID time Endtime duration Project host result status hour
the above query is giving correct results only, but there is some transactions which is not having 'Ending session', for some transaction there is no 'Beginning and ending session'. I know that where the beginning and end session are not there were incomplete transactions and their status is error. but I am not getting those DIDs in my output, I am getting only where Beginning and ending session DIDs.
Pl help me to do this
here is some sample logs which not having beginning and ending sessions
Logs:
1. No Ending session but having 3-4 log lines
117,20150418 05:09:42.860,155,32,MIV,1615241 - 0xc64,-P -R6801ddbc-1528-472f-805a-d9645c4ffa0c -I351 Beginning session
208,20150418 05:10:18.111,155,32,MIV,1615241 - 0xc64,-PC2BBD -R6801ddbc-1528-472f-805a-d9645c4ffa0c -I351 Processed package bc7f579a-6a59-495f-b23e-059ea49e963c from client 6801ddbc-1528-472f-805a-d9645c4ffa0c
208,20150418 05:12:21.193,155,32,MIV,1615241 - 0xc64,-PCX2J6 -R6801ddbc-1528-472f-805a-d9645c4ffa0c -I351 Processed package deca35af-62f4-4db4-8fa5-ff01784f085d from client 6801ddbc-1528-472f-805a-d9645c4ffa0c
No ending session with one log line
118,20150418 09:52:10.058,155,32,MIV,1634745 - 0x1aac,-P -Rbde65047-6274-4fbf-98bd-b8593b014dd9 -I152 Beginning session
For some dids there is no beginning session and endining session as per logs its starting with ‘session does not exist’
277,20150414 14:15:56.227,155,4,MIV,1333626 - 0x13a4,-P -R -I Session does not exist for 2dd0b5a3-bcbe-428f-b8b0-23aefc96e0a4
268,20150414 14:08:53.198,155,4,MIV,1333626 - 0x13a4,-P -R -I Session does not exist for 9edb5b57-85f1-47c6-a3e3-62ebf5767990
Thanks in advance
... View more