Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: transaction or join where the search field cha...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi I have a log with entries similar to below
11:32:12,988 INFO [LOG TYPE: REQUEST] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...
11:32:14,364 SEVERE [LOG TYPE:EXCEPTION] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...
11:32:14,364 INFO [LOG TYPE:RESPONSE] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...
What I'm looking for is a search which displays all 3 which have the same REQUEST ID if it finds a SEVERE or LOG TYPE:EXCEPTION
Transaction almost sounds like what I want so I tried the following
sourcetype=cas SEVERE | transaction RequestId maxspan=5s maxpause=5s
However this only brings back the SEVERE entry.
Is there a way to do this with transaction or should I be looking at JOIN?
Thanks for your assistance
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Comment for now as I'm half asleep spinning a theory:
One thought is search for all records with a RequestId, do the transaction, and then use either a search or where command to filter the results to only include those. e.g.
sourcetype=cas RequestId=* | transaction RequestId ... | search SEVERE
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Comment for now as I'm half asleep spinning a theory:
One thought is search for all records with a RequestId, do the transaction, and then use either a search or where command to filter the results to only include those. e.g.
sourcetype=cas RequestId=* | transaction RequestId ... | search SEVERE
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
acharlieh you are a genius! It works!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well excellent then! converted comment to an answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cheers, thanks for such a quick response
What the End of Support for Splunk Add-on Builder Means for You
Solve, Learn, Repeat: New Puzzle Channel Now Live
Building Reliable Asset and Identity Frameworks in Splunk ES
