Question

1）我想用url调用的p（95）响应时间来计算HTTP URL的出现次数： https://example.net/v1/abc/xyz，响应代码为200或500 2）响应时间是时间戳b / w第6行和第6行的差异。 3。 3）URL调用＆amp;状态代码出现在同一个线程中，即Thread-30_Server_1，并且始终应该是下一个出现的如果您同时看到事件1和事件2发生在同一个线程中，但响应状态代码应始终是顺序的。因此，splunk搜索应返回事件1，其状态为200，其中 - 作为事件2，状态为350

以下是日志摘录：活动1：

Line1) 2017-11-10 03:05:38,826 10606295 INFO  (Thread-30_Server_1:) :Url in else part is:https://example.net/v1/abc/xyz
Line2) 2017-11-10 03:05:38,826 10606295 INFO  (Thread-30_Server_1:) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Line3) 2017-11-10 03:05:38,826 10606295 INFO  (Thread-30_Server_1:) HTTP url : https://example.net/v1/abc/xyz
Line4) 2017-11-10 03:05:38,826 10606295 INFO  (Thread-30_Server_1:) Body: [{"itemID":"42650750083","uom":"EACH","toZipCode":"112173111","qty":1,"channel":"dotcom"}]
Line5) 2017-11-10 03:05:38,826 10606295 INFO  (Thread-30_Server_1:) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Line6) 2017-11-10 03:05:39,012 10606481 INFO  (Thread-30_Server_1:) :Status Code is:200
Line7) 2017-11-10 03:05:39,012 10606481 INFO  (Thread-30_Server_1:) :Status message is:"Success"
Line8) 2017-11-10 03:05:39,012 10606481 INFO  (Thread-30_Server_1:) Exit call and 3

活动2：

Line101) 2017-11-10 03:05:39,364 10606833 INFO  (Thread-30_Server_1:) Enter call with 5 attributes
Line102) 2017-11-10 03:05:39,364 10606833 INFO  (Thread-30_Server_1:) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Line103) 2017-11-10 03:05:39,364 10606833 INFO  (Thread-30_Server_1:) HTTP url : https://example.net/v2/mmm/nnn
Line104) 2017-11-10 03:05:39,364 10606833 INFO  (Thread-30_Server_1:) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Line105) 2017-11-10 03:05:39,442 10606911 INFO  (Thread-30_Server_1:) ####################################################################
Line106) 2017-11-10 03:05:39,442 10606911 INFO  (Thread-30_Server_1:) Output from Server
Line107) 2017-11-10 03:05:39,442 10606911 INFO  (Thread-30_Server_1:) {"status":350,"message":"Success","body":[{"shortageQty":0,"reservedQty":1,"partiallyReservedQty":0,"problemType":"SUCCESS"}}]}
Line108) 2017-11-10 03:05:39,442 10606911 INFO  (Thread-30_Server_1:) ####################################################################
Line109) 2017-11-10 03:05:39,442 10606911 INFO  (Thread-30_Server_1:) :Status Code is:350
Line110) 2017-11-10 03:05:39,442 10606911 INFO  (Thread-30_Server_1:) :Status message is:"Success"
Line111) 2017-11-10 03:05:39,442 10606911 INFO  (Thread-30_Server_1:) Exit call

Answer 1

首先，为什么您的Splunk时间戳与日志时间戳不同？您需要将基本配置应用于props.conf以进行正确的titmestamping和linebreaking。我会在做其他事之前解决这个问题。

第二部分可以通过将2行组合成单个事件然后添加where子句来仅返回状态= 200 AND status = 350

的事件来解决

使用事务进行Splunk日志记录

1 个答案: