"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
Register before May 13 to save $200 on .conf 2011 the 2nd Annual Splunk Worldwide Users’ Conference.
Forbes and Fortune Identify Splunk as Next Big Thing--Learn How You Can Transform Your Business at the Splunk Worldwide Users' Conference in August
Splunk is helping thousands of organizations like yours every day to leverage the gold in theirmachine-generated data to grow and innovate.
Join us at Splunk .conf 2011 and learn how Splunk can make maximum business sense of your machine data. Whether you are a wet behind the ears newbie or power user looking for guru status, .conf has something for you. Fortune, Forbes and CIO Magazine are calling us the “Next Big Thing.” That’s because Splunk and our customers are quickly growing to the next level—creating better products, better insights, better opportunities. Now’s the perfect time to join us, take your Splunk knowledge to the next level and be a part of the revolution.
Only at .conf can you exchange hands-on knowledge, share best practices and learn from the best and brightest minds in the industry. Get up to speed and walk away with the real-world info you need to make the most of your Splunk investment. The 2nd Annual Splunk Worldwide Users’ Conference is a must-attend event that features:
- General sessions detailing the latest trends like cloud, virtualization, web intelligence, big data and how Splunk can help you make sense of the resulting complexity
- Meals and roundtable discussions with Splunk executives, engineers, services, support staff and Splunk’s other cutting edge clients like you
- Scope out 54 sessions across 5 tracks: Customer Scenarios/ Use Cases, Deploying Splunk, Extending Splunk, Inside Splunk, and Using Splunk
- Splunk Solutions Center showcasing the latest Splunk and Partner-built apps from Amazon Web Services, Blue Coat, Cisco, Citrix, F5, Microsoft, Palo Alto Networks, VMware and more
- Splunk Answers Lab pairing you with your favorite Splunkers in dev, pro services and support to take your Splunk instance to “next big thing” status
Register before May 13 and save $200.
Bring your team! Bring 3 people, get the 4th free.
Views: 29
Comment
© 2012 Created by Michael Wilde.
You need to be a member of splunkninja to add comments!
Join splunkninja