We're trying to count the number of times a particular call is made to a service. To do that, we're logging a log line for every call, one that contains a well-known string, to a gunicorn file (one file per instance), which is then being picked up by Splunk for analysis.
When I search for these log lines, I find that what's returned are events, not lines -- and events have many lines in them. In some cases, I see four or six of the calls we're interested in logged, but count (when I use timechart) is equal to one. Emitting sum(linecount) doesn't produce the correct result either, since it emits the total number of lines in the event, not just the lines we're interested in. I can't seem to get it to return the correct number (four, six).
What's the way through? It seems like this is something Splunk should be able to do. I'm told it's possible that the parser we're using is wrong, but I don't see where I change that. Any hints would be very, very welcome.
Thanks for your time.
... View more