Splunk Search

Linking outbound and inbound messages, then finding incomplete ones

wardallen
Path Finder

I am analysing a logfile where there'll be a message that describes an outbound message going to an external system, and a short period of time later, a reciprocal message from the external system - a "job done" message, containing a unique deal ID common to both.
Finding the out and in messages won't be hard.
The hard part will be writing a query that tells me about all deal IDs that have an outbound but not an inbound component. What would be the best approach to do this?

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

I can think of at least the following (where deal_ID would be the field that contains the ... deal ID);

... | transaction deal_ID | where eventcount < 2

and slightly faster:

... | stats count by deal_ID | where count < 2

/K

View solution in original post

kristian_kolb
Ultra Champion

I can think of at least the following (where deal_ID would be the field that contains the ... deal ID);

... | transaction deal_ID | where eventcount < 2

and slightly faster:

... | stats count by deal_ID | where count < 2

/K

kristian_kolb
Ultra Champion

The first search will return the whole outbound event, and the second search will just return the deal_ID of the lonely outbound event.

/k

wardallen
Path Finder

Also, there will be other pairs starting/finishing at the same time. Processing is not linear.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...