About thinksplunk

thinksplunk · ‎10-03-2013

2013-09-20 16:53:04,723 INFO[Thread-3]EndTime=20/09/2013 16:53:04 TransactionID=A, Event=completed, Result=sent 2013-09-20 16:03:04,723 INFO[Thread-3]EndTime=20/09/2013 16:53:04 TransactionID=b, Event=completed, Result=sent 2013-09-20 13:52:04,723 INFO[Thread-3]StartTime=20/09/2013 16:52:04 TransactionID=Ab, Event=start_process 2013-09-20 09:52:04,723 INFO[Thread-3]StartTime=20/09/2013 16:52:04 TransactionID=Ab, Event=start_process If i need to get the # of transaction every hour as belows, what would be the search statement? Date Transaction count 2013-09-20 09 1 2013-09-20 13 1 2013-09-20 16 2

thinksplunk · ‎10-01-2013

yes i thought the command ...| transaction TransactionID | ... will return the correct results but it is not. If use ...TransactionID..., it will return the correct results, how come?

thinksplunk · ‎10-01-2013

2013-09-25 23:23:34 .....TransactionID=abc 2013-09-25 14:23:34 .....TransactionID=dec 2013-09-24 05:42:53......TransactionID=dec 2013-09-22 12:42:53......TransactionID=abc 2013-09-12 12:42:53......TransactionID=ads If i need group all event by TransactionID as show below, what will be the search command? Thks TransactionID Time abc 2013-09-25 23:23:34..... 2013-09-22 12:42:53..... dec 2013-09-25 14:23:34.... 2013-09-24 05:42:53...... ads 2013-09-12 12:42:53......

thinksplunk · ‎09-30-2013

correct, it is writing the right regex, as i mentioned i'm new in using Splunk, so not very sure how to write the right regex.

thinksplunk · ‎09-30-2013

To be exact, i need to filter the string is "2013-09-20 16:53:34,374 INFO [Thread-2] [null:-1] Success. Connected to AB Server at 192.11.12.13:123.

thinksplunk · ‎09-30-2013

If i need to extract two fields from below string "source=/app/cups-drink/test/iron13-machine5a-43machine.log" The first field name is "item" and value is "cups" The second field name is "system" and value is "43machine"

thinksplunk · ‎09-24-2013

Hi, as i'm new to using Splunk, i would like to know how to filter the string "2013-09-20 16:53:00, 231 Success transport" before it is index, how to do it and where to configure it? thks 2013-09-20 16:53:04,723 INFO[Thread-3]EndTime=20/09/2013 16:53:04 TransactionID=A, Event=completed, Result=sent 2013-09-20 16:53:00, 231 Success transport 2013-09-20 16:52:04,723 INFO[Thread-3]StartTime=20/09/2013 16:52:04 TransactionID=A, Event=start_process

thinksplunk · ‎09-23-2013

i am trying to extract the word "NUM" from source=c:/documents/app/test1/test12/controlNUM34/12.log.

thinksplunk · ‎09-23-2013

if i need to extract "num" from source=c:/documents/app/test1/test12/controlnum34/12.log and tag as field, how to go abt doing it? thks

thinksplunk · ‎09-22-2013

what i meant is that i want to have the below resulst for above lines of event based on event=start_process - event=completed for every transaction. TransactionID Time taken (1sec) A 60 B 90 C 20 ... etc

thinksplunk · ‎09-22-2013

2013-09-20 16:53:04,723 INFO[Thread-3]EndTime=20/09/2013 16:53:04 TransactionID=A, Event=completed, Result=sent 2013-09-20 16:52:04,723 INFO[Thread-3]StartTime=20/09/2013 16:52:04 TransactionID=A, Event=start_process If i need to calculate the total time for the above transaction (time taken of event=start_process - time taken for event=completed), how to go abt doing it?

Posts	11
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎09-22-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Count number of Transaction every hour

Group all events by same transaction

Filter strings of event before index

Regex from source

How to calculate the total time taken for each tra...

Count number of Transaction every hour

Re: Group all events by same transaction

Group all events by same transaction

Re: Filter strings of event before index

Re: Filter strings of event before index

Re: Regex from source

Filter strings of event before index

Re: Regex from source

Regex from source

Re: How to calculate the total time taken for each...

How to calculate the total time taken for each tra...