Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to count the occurrence of a field/string per transaction for events grouped with the transaction command?

$
0
0
I have custom log file in which we all logging various activities in a transaction context (correlation ID). In this particular case, we have a Rest Search to get price detail. Service accept 1 or more (can go to several thousand) SKUs and return price either from cache, or DB. log is generated for each SKU. I have grouped all events using transaction command using the **CorrelationId** field. How do I count the number of cache hit or miss perc all. Tried below, but this did not give me the answer: index=pii sourcetype=pii:runway:service-log host=price-PriceService-prod* | transaction CorrelationId maxspan=15s | stats count(eval(SkuPriceCache="Hit")), count(eval(SkuPriceCache="Miss")) by CorrelationId I can see eventocunt over 1000, but cachehit or miss is never more than 10 in this case.

Viewing all articles
Browse latest Browse all 47296

Trending Articles