Splunk Search

Transaction Duration Duplicated due to multiple same event

YoussefB
Engager

Hello,

I'm trying to get the duration of a transaction starting with "green" and stopping with "red" :
The problem is that when i have data like this :

  • time_001 Green
  • time_002 Green
  • time_003 Red
  • time_004 Red
  • time_005 Green
  • time_006 Red
  • time_007 Green
  • time_008 Green
  • time_009 Red

The calculated duration is ko because of the duplicated events.
This is my search query :
host="Data_Host" "Connected"
| rex ="Host (?.) - (?.)"
| transaction host startswith="*Green
" endswith="Red"
| stats sum(duration) as "uptime_duration" by ligneNum
| convert timeformat="%d/%m/%y-%H:%M:%S" ctime(_time) AS "uptime_duration"
| fieldformat uptime_duration=tostring(uptime_duration,"duration")

I want my transactions to ignore the same redondant successif colors.
the result should be something like :
- time_001 Green
- time_003 Red
- time_005 Green
- time_006 Red
- time_007 Green
- time_009 Red

Tags (1)
0 Karma

YoussefB
Engager

Hello,

I already tested : dedup color
But the result is not what i expected.
can you give more informations about dedup filters ?

0 Karma

davebrooking
Contributor

I doubt if this is the most elegant way, it may not even be a correct way (reading the documentation dedup should keep the most recent event) but using reverse prior to the dedup seems to keep the events you want (if time_001 is earlier than time_002).

Try something like
...
| rex ="Host (?.) - (?.)"
| reverse
| dedup color consecutive=t
| sort -_time
| transaction host startswith="Green" endswith="Red*"
| ...

Dave

ahrefai
Engager

try dedup; a filtering command for removing redundunt data that match specific criteria

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...