Splunk Search

Searching by Transaction TYPE

mikefoti
Communicator

The following query finds what I would call "RejectedTrasnactions"

index="radius"  | transaction nps_Class maxspan=1s startswith=(eventtype=nps_accessRequested) endswith=(eventtype=nps_accessReqRejected)| timechart count by nps_callingStation

I use a similar query to find "AcceptedTrasnactions"

If opt to add appropriate code to transactions.conf, is there a way to gather stas based on transaction types? For example, would a query like this show me how many of each transaction type occurred per time period?

index="radius" |timechart count by transaction
Tags (2)
0 Karma
1 Solution

MarioM
Motivator

it's actually transactiontypes.conf but it only allow to call 1 transaction definition by using "... | transaction name=mytransactiondef ..." and this "name" field doesnot seems to be searchable.

Then i would try a different way either using summary indexing & marker or eval & case function

View solution in original post

0 Karma

MarioM
Motivator

it's actually transactiontypes.conf but it only allow to call 1 transaction definition by using "... | transaction name=mytransactiondef ..." and this "name" field doesnot seems to be searchable.

Then i would try a different way either using summary indexing & marker or eval & case function

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...