Splunk to Elastic query migration

Elastic Stack Elasticsearch
1

We have below Splunk query:

sourcetype=f5_access_log rescode=429 | transaction node,rescode maxevents=-1 maxpause=1s | search eventcount>1 duration > 1 | bin span=5 duration | top 100 duration

Can some one please help me in understanding transaction part of the query and how to implement the similar query in Elastic.

2

What do the Splunk docs say about the transaction part? I don't know that a heap of people that know it would be hanging out here.

3

:grinning: ok let me check my self. I will update this thread after my analysis.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.