Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Multiline Interleaved Transactions

$
0
0

I have a log file that contains multiple transactions. These transactions can span multiple lines. Since this is a multithreaded application, the transactions recorded for each user is interleaved. Fortunately, there is a thread id that I can use to segment each transaction.

How do I generate a transaction record for each user transaction?

Sample Data:


2013-09-15 08:09:49,371 127.0.0.1-exec-12 INFO UserId: abc123
2013-09-15 08:09:49,372 127.0.0.1-exec-12 INFO UserPartLookup?itemId=568
2013-09-15 08:09:49,387 127.0.0.1-exec-17 INFO UserId: xyz678
2013-09-15 08:09:49,392 127.0.0.1-exec-12 INFO LookupResultsComplete
2013-09-15 08:09:49,395 127.0.0.1-exec-17 INFO UserOrder?itemId=568
2013-09-15 08:09:49,392 127.0.0.1-exec-17 INFO LookupResultsComplete

Output Should be:


2013-09-15 08:09:49,371 127.0.0.1-exec-12 INFO UserId: abc123
2013-09-15 08:09:49,372 127.0.0.1-exec-12 INFO UserPartLookup?itemId=568
2013-09-15 08:09:49,392 127.0.0.1-exec-12 INFO LookupResultsComplete

2013-09-15 08:09:49,387 127.0.0.1-exec-17 INFO UserId: xyz678 2013-09-15 08:09:49,395 127.0.0.1-exec-17 INFO UserOrder?itemId=568 2013-09-15 08:09:49,392 127.0.0.1-exec-17 INFO LookupResultsComplete

My guess is the search should be something like: | rex field=_raw "^.+exec-(?<thr_id>d{2})" | transaction startswith="UserId:" endswith="LookupResultsComplete"

Thanks.


Viewing all articles
Browse latest Browse all 13053

Trending Articles