Splunk：组合多行的字段

Question

上下文

假设我的日志结构是这样的

TID: http-incoming-972453 >> POST /token HTTP/1.1 {org.apache.synapse.transport.http.headers} # I want this
TID: http-incoming-972453 >> Accept: application/json {org.apache.synapse.transport.http.headers}
TID: http-incoming-972453 >> Host: some.organization.com {org.apache.synapse.transport.http.headers}
.....
TID: http-outgoing-8816 >> POST /oauth2/token HTTP/1.1 {org.apache.synapse.transport.http.headers}
TID: http-outgoing-8816 >> Content-Type: application/x-www-form-urlencoded {org.apache.synapse.transport.http.headers}
TID: http-outgoing-8816 >> Transfer-Encoding: chunked {org.apache.synapse.transport.http.headers}
TID: http-outgoing-8816 >> Host: some.other.organization.intra:9444 {org.apache.synapse.transport.http.headers}
TID: http-outgoing-8816 >> Connection: Keep-Alive {org.apache.synapse.transport.http.headers}
TID: http-outgoing-8816 >> User-Agent: Synapse-PT-HttpComponents-NIO {org.apache.synapse.transport.http.headers}
TID: http-outgoing-8816 << HTTP/1.1 200 OK {org.apache.synapse.transport.http.headers}
.....
TID: http-incoming-972453 << HTTP/1.1 200 OK {org.apache.synapse.transport.http.headers} # with this
TID: http-incoming-972453 << X-Frame-Options: DENY {org.apache.synapse.transport.http.headers}
.....

我已经调整了props.conf 以便

TID: http-incoming-972453 >> POST /token HTTP/1.1 {org.apache.synapse.transport.http.headers}

以下列字段结束索引

• httpRequestId：972453
• 资源名称：/token

和

TID: http-incoming-972453 << HTTP/1.1 200 OK {org.apache.synapse.transport.http.headers}

与

• httpRequestId：972453
• httpStatus：200

我正在寻找一种计算请求的方法，由 httpStatus 和 ressourceName 聚合，使用 httpRequestId 作为连接

尝试

由于有关ressourceName 和httpStatus 的信息发生在不同的事件中，我想到了使用join。这没有给出任何结果

index=* role="gw" httpAction="incoming" | join type=outer httpRequestId [fields ressourceName,httpStatus] | stats count by ressourceName,httpStatus

在阅读 Splunk 文档时，我还遇到了selfjoin，结果只有部分

index=* role="gw" httpAction="incoming" | selfjoin httpRequestId | stats count by ressourceName,httpStatus

如何组合来自多个事件的字段以得到类似的结果

/somewhere           200         30
/somewhere           403         1
/somewhere/else      200         15

Answer 1

您对 join 的使用不正确。子搜索必须是有效搜索，以“search”或“|”开头。

试试stats 命令。

index=foo role=gw httpAction="Incoming
| stats values(*) as * by httpRequestId

Answer 2

你可能想看看使用事务命令。

index=* role="gw" httpAction="incoming" | transaction httpRequestId | stars count by ressourceName,httpStatus

根据您要分析的数据量和时间范围，事务或连接就足够了。