"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
David Croteau's Discussions
SingleValue with LinkSearch does not accept results as pull down
In 4.0.7 SingleValuelinkSearch = search terms* Specify a valid complete search to turn the result into a clickable link.So we try to pass in the results of a saved search and the results do not show…Continue
Tags: LinkSearch, SingleValue, HiddenSearch
Started Dec 23, 2009
David Croteau's Page
Gifts Received
David Croteau has not received any gifts yet
Latest Activity
David Croteau posted a discussionSingleValue with LinkSearch does not accept results as pull down
In 4.0.7 SingleValuelinkSearch = search terms* Specify a valid complete search to turn the result into a clickable link.So we try to pass in the results of a saved search and the results do not show up as choices in the dropdown. Anyone have success with this is 4.0.7See More
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- Splunk SE
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
