Splunk Search

Transaction

ncbshiva
Communicator

Hi

This is my search query
source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry".

Now i want to evaluate count of "Errors" word from the above result.

Please help me..........

Tags (1)
0 Karma
1 Solution

ChhayaV
Communicator

hi,
Append search Errors to your query

source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry" | search Errors | stats count

hope this helps

View solution in original post

ncbshiva
Communicator

This is the sample log

[M2E-CSI]2013-06-11 01:19:40,924 PDT - Hydra is starting Control Channel
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable

0 Karma

ChhayaV
Communicator

hi,
Append search Errors to your query

source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry" | search Errors | stats count

hope this helps

ChhayaV
Communicator

hi,
if you will not use transaction simply right
source="-----.log" Error |stats count

you will get count as 5

0 Karma

ncbshiva
Communicator

Example i should get the count of "Error" word as 5

0 Karma

ncbshiva
Communicator

Please see the sample log and help me to get the count of "Error"

0 Karma

ncbshiva
Communicator

I am not getting proper count ........

0 Karma

linu1988
Champion

Please provide sample log.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...