I have 20 records in a transaction. Each of those records has a status. Possible status are created, opened, closed, accepted, rejected and they can occur multiple times in one transaction. An example would be created opened closed opened closed accepted Now, I want to find out two durations. From created till the last occurence of closed, and from created to accepted. The last one is easy, I just don't provide startswith/endswith parameters. But getting the duration until the last occurence of closed is tricky. Because endswith would take the first occurence of closed to end the transaction. And I can't count either, because well I don't know how many records there are after the last closed. Now it's one, but it might as well could be three. How would I go about doing this? ... View more

Due to various cross references, I am forced to use nested transactions. In other words, I group several events into a transaction, and then I group several of those transactions in yet another transaction. And it works the way I want it to, except... The time of a transaction is the same as the time of the first event. So the duration of the last transaction is calculated as the difference between the starttime of the first transaction and the starttime of the last transaction. In stead, I need the difference between the starttime of the first transaction and the endtime of the last transaction. How would I go about doing this? ... View more

My current situation is the following: There are 26 messages that can be sent between three parties. There are 3 possible scenario's. Either the first 10 messages get sent, the first 18 messages get sent or all 26 messages get sent. Unless an error occurs somewhere down the road which ends the message flow. Every message is logged and has a unique MessageID and a ProjectID. The ProjectID is unique for that specific flow of messages. An error message is also logged but has no ProjectID, in stead it logs the MessageID where the error occured. Now, I've managed to group those messages in a transaction with ProjectID. No problems there. My issue is that I want to incorporate the error message in the transaction but adding the MessageID like this | transaction ProjectId, MessageID does not work. How would I go about doing this? ... View more

This is how my WebLogic logs look : <TimestampUntilSeconds> <Fixed Number of Other tags here> <1369087465001> More data here As you can see, they have a timestamp in the beginning, then they have some other information , then there's the time in milliseconds since 1970 and then there's the rest of the log. Now, as expected, Splunk takes the first timestamp and ignores what appears to be a random number. But the timestamp is not accurate enough for me, so I would like to store the last three digits of the number as the milliseconds. How would I go about that? ... View more

I am very new to Splunk and this may be a rookie question but I cannot find this anywhere. I have a custom generated demo log file with 1000 similarly structured lines. For some reason, Splunk reads in the first 257 lines as one event, and then the next 743 lines as separate events. I figured it had something to do with either LINE _ BREAKER or MAX _ EVENTS but the strange thing is that it's not consistent. I would be less surprised if it grouped all my events per 257 in stead of just the first 257 and then single event per line from there on. Could it perhaps have something to do with the fact that I don't have a timestamp added yet? ... View more