Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jswarren
jswarren
New Member
Member since:
07-28-2015
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-28-2015 |
Activity Feed
- Posted Re: How do I keep startswith from evicting a previous transaction? on Splunk Search. 07-29-2015 11:48 AM
- Posted Re: How do I keep startswith from evicting a previous transaction? on Splunk Search. 07-29-2015 11:45 AM
- Posted Re: How do I keep startswith from evicting a previous transaction? on Splunk Search. 07-29-2015 08:54 AM
- Posted Re: How do I keep startswith from evicting a previous transaction? on Splunk Search. 07-29-2015 08:52 AM
- Posted Re: How do I keep startswith from evicting a previous transaction? on Splunk Search. 07-29-2015 06:46 AM
- Posted How do I keep startswith from evicting a previous transaction? on Splunk Search. 07-28-2015 03:35 PM
- Tagged How do I keep startswith from evicting a previous transaction? on Splunk Search. 07-28-2015 03:35 PM
- Tagged How do I keep startswith from evicting a previous transaction? on Splunk Search. 07-28-2015 03:35 PM
- Tagged How do I keep startswith from evicting a previous transaction? on Splunk Search. 07-28-2015 03:35 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
07-29-2015
11:48 AM
Or...I would post the update, if I had enough karma....
Assume that there are more events before the "Executing..." and after the "Completing" that should be excluded.
... View more
07-29-2015
11:45 AM
Ahh...yes...that would work, if there weren't "noise" between functions....I'll update the example to reflect that noise.
... View more
07-29-2015
08:54 AM
Answers to your questions:
No, it's not always "function a", it could be one of hundreds or thousands of different function names.
Yes, the events are in order and the process that writes the log is single-threaded.
I still have to have some way to identify the start of a transaction. What other options could I consider?
... View more
07-29-2015
08:52 AM
It's not the endswith that is the problem - I can successfully filter out the incorrect "ends". I can't filter out the incorrect "starts" because they are identical to each other. I need to somehow tell transaction to ignore repeated starts.
... View more
07-29-2015
06:46 AM
If I do that, it results in two transactions, one from 12:00:01 - 12:00:04 and another from 12:00:05 - 12:00:08, which is not the desired outcome. The explicit "value=0" is requred.
... View more
07-28-2015
03:35 PM
Assume I have an input file like the following:
2015-07-28 12:00:01 Executing function a...
2015-07-28 12:00:02 debug1
2015-07-28 12:00:03 debug2
2015-07-28 12:00:04 Completing function a (value=-1)
2015-07-28 12:00:05 Executing function a...
2015-07-28 12:00:06 debug3
2015-07-28 12:00:07 debug4
2015-07-28 12:00:08 Completing function a (value=0)
I want to build a transaction object that begins with the first line and ends with the last. If I use startswith="Executing function a..." and endswith="Completing function a (value=0)" , it appears that the second Executing function a... evicts the first, even though an endswith has not occurred. I end up with a single transaction that begins at 12:00:05 and ends at 12:00:08, and the earlier is an incomplete transaction.
Is there any way to get transaction not to evict the previous transaction when it encounters another startswith (prior to an endswith )?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
