"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
Caio Santos's Discussions
my forwarded data doesn't appear on the receiver server
1 Reply
Hey everybody,I've got an issue that is taking time to solve it.I just can't figure out why the forwarded data is not showing up on the summary panel, but the data still being forwarded because I…Continue
Tags: forwarder
Started this discussion. Last reply by Michael Wilde Sep 27, 2010.
Caio Santos's Page
Gifts Received
Caio Santos has not received any gifts yet
Latest Activity
Michael Wilde replied to Caio Santos's discussion my forwarded data doesn't appear on the receiver server"did you specify a particular index that your forwarded data is going to. By default, the Admin role in Splunk only searches the "main" index by default, so the stats on the "Search Summary" page will only reflect that index. If…"
Caio Santos posted a discussionmy forwarded data doesn't appear on the receiver server
Hey everybody,I've got an issue that is taking time to solve it.I just can't figure out why the forwarded data is not showing up on the summary panel, but the data still being forwarded because I checked the index out on the receiver and it is increasing.Well,Thanks in advance.See More
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- Programming
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
