Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Search, top, count inside a transaction

$
0
0

Hi! I would like to know the frequency of each value of a certain field inside a transaction, for example: my event after transaction (mvlist=t) are

23/07/2013 17:09 userdi1 value1
                 userid1 value2
                 userid1 value1
                 userid1 value3
                 userid1 value2
                 userid1 value1

23/07/2013 14:09 userid2 value2
                     userid2 value2
                     userid2 value2
                     userid2 value3
                     userid2 value2
                     userid2 value3

I wish to get the result:

23/07/2013 17:09 userdi1 value1 3
                         value2 2
                         value3 1

23/07/2013 14:09 userid2 value2 4
                         value3 2

I think to need transaction because in my log I have more than one "event" (section) for the same user. This search

 index=ing sourcetype=callcenter | transaction maxpause=30m cif mvlist=t | stats count(value) by value

doesn't work. My impression is that top or something similar inside a transaction without breakink it it impossible. Any suggestion? Thanks for your time


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>