Application: Tranaction eventbreaker
Categories:
Description
When doing a CLI search for transactions, it can be hard to know the start and end points of the events. This script adds line breaks (with timestamps) between the events.
To use the script:
- download the script into $SPLUNK_HOME/etc/searchscripts
- make sure the script has the right permissions and owner
- if using the enterprise version make appropriate changes to authorize.conf
- pipe search results to eventbreaker
cheezburglar:deep $ ./splunk search " sourcetype=transaction | transam fields=id | eventbreaker"
Rating
(0 votes)
Login to rate this Application