"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
Past Events (2)
June 20Monday
-
Austin - Splunk User Group
June 20, 2011 from 6pm to 8pm – National Instruments User group is goin down in Austin. Monday June 21, 2011 at National Instruments. Details are here at Meetup.com. Sign up and come! Organized by Michael Wilde | Type: splunk, user, group
August 9Monday
-
.conf: Splunk's Worldwide Users' Conference
August 9, 2010 at 8am to August 11, 2010 at 5pm – The Palace Hotel It's only your first time once... Be there for the first Splunk Worldwide Users' Conference. Register today: http://www.splunk.com/goto/conference Organized by Erin Sweeney | Type: users', conference
© 2012 Created by Michael Wilde.
