Splunk Search

How to write a complex transaction Search

vasanthmss
Motivator

Hi There,

Identify the transaction duration based on individual field, field3,fiel4 values. Events may not be same as below sample, events may be indexed like a,b,a,a,a,b,b,c.

Transaction Rule,

Transaction starts when the events field1, field2 has 1,0 with continuous field1,fiel2 has 1,1 then pick the first event time.
Transaction ends with either field1,fiel2 has 8,0 or 9,0.

Sample Events,

time    field   field1 field2 field3 field4 
.   a   1   0   xx  xx *
.   a   1   1   xx  xx 
    a   1   0   xx  xx
    a   2   1   xx  xx
    a   1   0   xx  xx  
    a   9   0   xx  xx *

    a   1   0   xy  xx *
    a   1   1   xy  xx
    a   1   0   xy  xx
    a   2   1   xy  xx
    a   1   0   xy  xx  
    a   8   0   xy  xx *

    b   1   0   xx  xx *
    b   1   0   xx  xx  
    b   1   0   xx  xx
    b   1   1   xx  xx
    b   x   x   xx  xx
    .
    .
    .
    b   9   8   xx  xx
    b   8   0   xx  xx *

Expected Results,

field   fiele2  field3  duration
a   xx      xx      10:00
a   xy      xy      5:00
b   xx      xx      15:00
V
Tags (2)
1 Solution

emiller42
Motivator

You didn't explicitly mention it, but it's implied by your example, that the transaction is grouped on field. (a, b, c, etc) That being the case, the below should work for you. The startswith and endswith params are treated like searches when surrounded by parens, which lets this work. Note that depending on how long your transactions actually are, you may need to also set maxevents or maxspan as well.

... | transaction field startswith=(field1=1 AND field2=0) endswith=((field1=8 OR field1=9) AND field2=0)

*note: the AND's in the above are technically redundant, but included for clarity

View solution in original post

emiller42
Motivator

You didn't explicitly mention it, but it's implied by your example, that the transaction is grouped on field. (a, b, c, etc) That being the case, the below should work for you. The startswith and endswith params are treated like searches when surrounded by parens, which lets this work. Note that depending on how long your transactions actually are, you may need to also set maxevents or maxspan as well.

... | transaction field startswith=(field1=1 AND field2=0) endswith=((field1=8 OR field1=9) AND field2=0)

*note: the AND's in the above are technically redundant, but included for clarity

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...