Let's break down the search piece by piece:
|
Search fragment |
Description |
| index=main sourcetype=log4j |
In this example, we are searching for our application logs, which have the log4j sourcetype. |
| | transaction maxspan=4h threadId |
Using the transaction command, we essentially consolidate multiple events with a common threadId into single-event multiline transactions. The maxspan function tells Splunk to only look at events with the same threadId that are within 4 hours of each other. The transaction command also calculates a new field called duration. This is the duration in seconds from the first event in the transaction to the last event in the transaction. |
| | timechart span=6h max(duration) AS max, mean(duration) ... |
