Getting Data In

How to restrict transaction to group events from the same source and the same host?

xinde
Path Finder
  • Search a same log file on many different hosts .
  • Use transaction : startwith and endwith to capture one process within this log file.
  • Show the duration of this process for each host/source

    host="hosts"
    | rex field=_raw "Process(?.*)"
    | transaction ProcessName startswith="BEGIN" endswith="END"
    | eval durationMin = round(duration/60,0)
    | chart values(durationMin) by host
    The search return - msg from different host/source got grouped together.
    Is there a way to restrict transaction events only on same host/source?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try using stats instead of chart.

host="*hosts*" 
| rex field=_raw "Process(?<ProcessName>.*)" 
| transaction  ProcessName startswith="BEGIN" endswith="END"
| eval durationMin = round(duration/60,0)
| stats values(durationMin) by host, source

If you share some sample events, we may be able to help you improve search performance by eliminating the transaction command.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using stats instead of chart.

host="*hosts*" 
| rex field=_raw "Process(?<ProcessName>.*)" 
| transaction  ProcessName startswith="BEGIN" endswith="END"
| eval durationMin = round(duration/60,0)
| stats values(durationMin) by host, source

If you share some sample events, we may be able to help you improve search performance by eliminating the transaction command.

---
If this reply helps you, Karma would be appreciated.
0 Karma

xinde
Path Finder

stats by host , source works!! thanks very much!

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...