×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
sriramfcam
New Member
Member since: ‎01-03-2019
‎06-05-2020
Community Statistics
Posts 5
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎01-03-2019
Activity Feed
View All

Re: How do i track a call across various indexes

by in Security
‎01-10-2019 11:33 AM
‎01-10-2019 11:33 AM
Sorry.....prior data was wrong 01/08/2019 16:49:11.045 app=A, guid=12345678, event=startAPI 01/08/2019 16:49:11.046 app=A, guid=12345678, event=endAPI 01/08/2019 16:49:11.047 app=B, guid=12345678, event=startAPI 01/08/2019 16:49:11.055 app=B, guid=12345678, event=endAPI 01/08/2019 16:49:11.056 app=A, guid=12345678, event=startAPI 01/08/2019 16:49:11.062 app=A, guid=12345678, event=endAPI 01/08/2019 16:49:11.063 app=C, guid=12345678, event=startAPI 01/08/2019 16:49:11.073 app=C, guid=12345678, event=endAPI 01/08/2019 16:49:11.074 app=A, guid=12345678, event=startAPI 01/08/2019 16:49:11.090 app=A, guid=12345678, event=endAPI and yes, retention period is the same ... View more

Re: How do i track a call across various indexes

by in Security
‎01-08-2019 01:53 PM
‎01-08-2019 01:53 PM
here is the real data (i've removed the actual app and guid names and moved all the calls into 1 index. The question now becomes how I show when the call enters and leaves each app 01/08/2019 16:49:11.045 app=A, guid=12345678, event=startAPI 01/08/2019 16:49:11.046 app=A, guid=12345678, event=endAPI 01/08/2019 16:49:11.047 app=B, guid=12345678, event=startAPI 01/08/2019 16:49:11.055 app=B, guid=12345678, event=endAPI 01/08/2019 16:49:11.056 app=A, guid=12345678, event=startAPI 01/08/2019 16:49:11.062 app=A, guid=12345678, event=endAPI 01/08/2019 16:49:11.063 app=C, guid=12345678, event=startAPI 01/08/2019 16:49:11.073 app=C, guid=12345678, event=endAPI 01/08/2019 16:49:11.074 app=A, guid=12345678, event=startAPI 01/08/2019 16:49:11.090 app=A, guid=12345678, event=endAPI ... View more

Re: How do i track a call across various indexes

by in Security
‎01-03-2019 02:54 PM
‎01-03-2019 02:54 PM
How do i group them using coalesce say my data is 12:00:00 app=A, 12:00:01 app=A 12:00:02 app=B 12:00:03 app=B 12:00:04 app=A 12:00:05 app=A, 12:00:06 app=C 12:00:07 app=C 12:00:08 app=A 12:00:09 app=A ... View more

Re: How do i track a call across various indexes

by in Security
‎01-03-2019 12:21 PM
‎01-03-2019 12:21 PM
Distributed apps - hence the different indexes That solution does not help out if we have back and forth calls between indexes I'm doing the following |stats earliest(_time) as starttime, latest(_time) as stoptime by index |sort starttime This gives me index index1 1545851255 1545851259 index2 1545851256 1545851257 index3 1545851257 1545851258 This does not show each entry and exit into indexes... I would like the output to be something like index1 1545851255 1545851256 index2 1545851256 1545851257 index3 1545851257 1545851258 index1 1545851258 1545851259 any ideas?? ... View more

How do i track a call across various indexes

by in Security
‎01-03-2019 11:19 AM
‎01-03-2019 11:19 AM
Each API call has a unique transactionID. The api call goes thru various indexes. How do i track the progress of the call (ie when the call enters and leaves each index)? The problem is made harder by the fact that sometimes a call goes from index1 to index2, returns to index1, then goes to index 3.....and so on ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM