Splunk Search

How to find incomplete transactions outside of a 30 day period

metersk
Path Finder

In the query below I am trying to find all users who logged in and then did not login again with in the time range. Unfortunately, is is not returning any results, which I know to be wrong by verifying for a specific UID.

earliest=-2d@d latest=-0d@d msg=login_daily `money_countries` | transaction uid startswith=(msg="login_daily") endswith=(msg="login_daily") keepevicted=true | search closed_txn=0 | table uid

Once I can get this working, I would like to find only unclosed transactions where there the absence of a second login comes 30 days after the first login. Is this possible?

0 Karma

woodcock
Esteemed Legend

You can do this with transaction but it is inefficient. I am not entirely sure I understand what you are trying to do (the confusion comes from the fact that your startswith and endswith strings are identical), but I think this will do it:

 msg=login_daily `money_countries` | streamstats latest(_time) BY uid AS prevTime | eval SecondsSincePrevEventByUID=(_time - prevTime) | where SecondsSincePrevEventByUID>=2592000

This adds a prevTime to each event that is the time of the previous event matching the same uid. If we then subtract these times, we can filter in those events that are 30 days (2592000 seconds) apart.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...