Splunk Search

How to write a search to omit transactions unless the URLs are different in the transaction?

edookati
Path Finder

I am using the below query, but i need to omit the transactions unless the URLs are different in the transaction.

index=olb_logs sourcetype="access-API" (URL="/bankapi/session" method=POST ) OR (URL="/bankapi/accounts" method=GET) | transaction sessionID maxspan=3s

Thanks.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Your URLs likely are stored in a multi-value field, so you can exploit that to filter:

... | where mvcount(URL) > 1

Alternatively, if you have to make sure two specific URLs are present, you can again use the multi-value property to filter like this:

... | search URL="/bankapi/session" URL="/bankapi/accounts"

Note, that's using an implicit AND instead of OR... both will yield true for the transactions you want because the MV field contains both values.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

It would be helpful if you can post some sample events and your expected output of transaction command.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

index=olb_logs sourcetype="access-API" (URL="/bankapi/session" method=POST ) OR (URL="/bankapi/accounts" method=GET) | dedup URL| transaction sessionID maxspan=3s
0 Karma

edookati
Path Finder

even this is not giving me accurate results.
Thanks a lot, for the response.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...