About marnee

WillTheOnly · ‎05-23-2022

@cstamilarasan You have to run the query after you edit it in order for the "Save" option to show. It took me a while to figure that out.

marnee · ‎12-22-2020

I want to find the first transaction that occurs after a different type of event. Let's say we have this event: "Service ready" Then we have these events: traceId=123 "Authentication started" traceId=123 "Authentication complete" I want to find this transaction: sourcetype=mytype | transaction traceId startswith="Authentication started" endswith="Authentication complete" But I want to filter these transaction and only see the first one that occurs after the "Service ready" event.

marnee · ‎12-02-2019

LOL, no problem, that makes more sense. Thanks much for the clarification and the links.

marnee · ‎10-21-2019

Thanks @somesoni2! This worked perfectly. "I wasn't sure if last item - "table PercentageGreater" - would work in the "single" element in the dashboard, but it did."

Posts	10
Solutions	0
Karma Given	21
Karma Received	7
Member Since	‎08-18-2016

Online Status	Offline
Date Last Visited	‎02-23-2024 01:03 PM

How to get the first transaction after an event of...

Which character(s) are not considered delimiters i...

How to display percentage of total events that hav...

Can you alter the Splunk search used for an alert?

Re: Can you alter the Splunk search used for an al...

How to get the first transaction after an event of...

Re: Which character(s) are not considered delimite...

Re: How to display percentage of total events that...