Splunk Search

How to avaiod multiple results while using transaction command?

karthi2809
Builder

Hi Guys,

Thanks in Advance.

I am using transaction command to fetch unique correlationId and i have multiple conditions to be match.below is my query .I am getting result.But not in proper way

 

 

 

index="mulesoft"     (message="API: START: /v1/fin_outbound") OR
(message="API: START: /v1/onDemand") OR (message="API: START: /v1/fin_Import") OR (message="API: START: /v1/onDemand") OR (*End of GL-import flow*) OR (tracePoint="EXCEPTION") OR (priority="WARN" AND *GLImport Job Already Running, Please wait for the job to complete*) OR (*End of GL Import process - No files found for import to ISG*) |transaction correlationId | search NOT message IN ("API: START: /v1/fin_Zuora_GL_Revpro_Journals_outbound")|rename content.File.fid as "TransferBatch/OnDemand" content.File.fname as "BatchName/FileName" content.File.fprocess_message as ProcessMsg content.File.fstatus as Status content.File.isg_file_batch_id as OracleBatchID content.File.total_rec_count as "Total Record Count"|eventstats min(timestamp) AS Start_Time, max(timestamp) AS End_Time by correlationId| eval JobType=case(like('message',"%API: START: /v1/onDemand%"),"OnDemand",like('message',"%API: START: /v1/onDemand%"),"OnDemand",like('message',"API: START: /v1/fin_Import"),"Scheduled")| eval Status=case(like('Status' ,"%SUCCESS%"),"SUCCESS", like('Status',"%ERROR%"),"ERROR",like('tracePoint',"%EXCEPTION%"),"ERROR",like('priority',"%WARN%"),"WARN",like('message',"%End of GL Import process - No files found for import to ISG%"),"ERROR")| eval ProcessMsg= coalesce(ProcessMsg,message)
| eval StartTime=round(strptime(Start_Time, "%Y-%m-%dT%H:%M:%S.%QZ")) 
| eval EndTime=round(strptime(End_Time, "%Y-%m-%dT%H:%M:%S.%QZ")) 
| eval ElapsedTimeInSecs=EndTime-StartTime 
| eval "Total Elapsed Time"=strftime(ElapsedTimeInSecs,"%H:%M:%S") 
|rename Logon_Time as Timestamp
 |table Status Start_Time JobType "TransferBatch/OnDemand"  "BatchName/FileName"  ProcessMsg OracleBatchID "Total Record Count" ElapsedTimeInSecs "Total Elapsed Time"  correlationId|fields - ElapsedTimeInSecs | search Status="*"

 

 

 

Screen shot added in that i want to show only yellow marked values

0 Karma

PickleRick
SplunkTrust
SplunkTrust

There is quite a lot going on here and I'm not fully sure you're getting proper results.

Anyway.

1. The "base" search is not very well done. Firstly, you're searching for separate short tokens instead of whole strings in some of those parentheses. Secondly, you use wildcards at the beginning of your search terms. It kills performance.

2. The transaction command combines values of the same field across the whole transaction. That's how it works.

3. I'd try to combine the events by stats instead of transaction of course. Transaction is best avoided if you can.

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...