Getting Data In

How to restrict transaction to group events from the same source and the same host?

xinde
Path Finder
  • Search a same log file on many different hosts .
  • Use transaction : startwith and endwith to capture one process within this log file.
  • Show the duration of this process for each host/source

    host="hosts"
    | rex field=_raw "Process(?.*)"
    | transaction ProcessName startswith="BEGIN" endswith="END"
    | eval durationMin = round(duration/60,0)
    | chart values(durationMin) by host
    The search return - msg from different host/source got grouped together.
    Is there a way to restrict transaction events only on same host/source?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try using stats instead of chart.

host="*hosts*" 
| rex field=_raw "Process(?<ProcessName>.*)" 
| transaction  ProcessName startswith="BEGIN" endswith="END"
| eval durationMin = round(duration/60,0)
| stats values(durationMin) by host, source

If you share some sample events, we may be able to help you improve search performance by eliminating the transaction command.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using stats instead of chart.

host="*hosts*" 
| rex field=_raw "Process(?<ProcessName>.*)" 
| transaction  ProcessName startswith="BEGIN" endswith="END"
| eval durationMin = round(duration/60,0)
| stats values(durationMin) by host, source

If you share some sample events, we may be able to help you improve search performance by eliminating the transaction command.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

xinde
Path Finder

stats by host , source works!! thanks very much!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!