Splunk Search

transaction or join where the search field changes but another field is common

stewartevans
Explorer

Hi I have a log with entries similar to below

11:32:12,988 INFO [LOG TYPE: REQUEST] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...
11:32:14,364 SEVERE [LOG TYPE:EXCEPTION] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...
11:32:14,364 INFO [LOG TYPE:RESPONSE] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...

What I'm looking for is a search which displays all 3 which have the same REQUEST ID if it finds a SEVERE or LOG TYPE:EXCEPTION

Transaction almost sounds like what I want so I tried the following

sourcetype=cas SEVERE | transaction RequestId maxspan=5s maxpause=5s

However this only brings back the SEVERE entry.

Is there a way to do this with transaction or should I be looking at JOIN?

Thanks for your assistance

Tags (3)
1 Solution

acharlieh
Influencer

Comment for now as I'm half asleep spinning a theory:

One thought is search for all records with a RequestId, do the transaction, and then use either a search or where command to filter the results to only include those. e.g.

sourcetype=cas RequestId=* | transaction RequestId ...   | search SEVERE

View solution in original post

acharlieh
Influencer

Comment for now as I'm half asleep spinning a theory:

One thought is search for all records with a RequestId, do the transaction, and then use either a search or where command to filter the results to only include those. e.g.

sourcetype=cas RequestId=* | transaction RequestId ...   | search SEVERE

stewartevans
Explorer

acharlieh you are a genius! It works!!

acharlieh
Influencer

Well excellent then! converted comment to an answer.

0 Karma

stewartevans
Explorer

Cheers, thanks for such a quick response

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...