Splunk Search

How to write a transaction search where startswith has the same value as endswith?

jo_za_b_m
Engager

Hello,

I am kind of new to Splunk and unfortunately I ran out of Ideas how to solve the problem i'm facing.
I need to know the Time between two events with the same Values. Is that possible?
an Example:

| transaction testparam mvlist=t startswith=eval(value="1") endswith=eval(value="1")  | table duration

value is a trigger in the testdata.

Is there maybe some sort of join I could use, or an option like minpause.

If anyone has an idea how to solve this or a clue, I'll be very thankful.

Greetings

MuS
SplunkTrust
SplunkTrust

Hi jo_za_b_m,

try something like this:

 <your base search here> value="1" 
| stats earliest(_time) AS e_time latest(_time) AS l_time 
| eval duration=l_time-e_time | convert crime(duration) | ...

maybe you need to add a by clause to the stats and any further needed fields. But this should do the job for you.

hope this helps ...

cheers, MuS

0 Karma

jo_za_b_m
Engager

Hi Mus,
thank you for fast response

the Problem within this is that i get the earliest and the latest value="1".
What i need is that the Value="1" (endswith) appears in the next transaction as Value="1"(startswith).
I need the duration time between every Value="1" 's.

Another solution which would help would be to include a different Value="2" in the Middle, which exists in the data and is always between the 1's.

What i tried to do so is following.

index="test" | transaction param mvlist=t startswith=eval(Value="1") endswith=eval(Value="2") | table param Create_time Value | append  [search index="test" | transaction param mvlist=t startswith=eval(Value="2") endswith=eval(Value="1")  |  eval mvindex(Value,-1) = 77 ] | table param Create_time Value

then my next step would have been to combine or make a transaction from Value="1" to Value="77" but the assignment eval mvindex()=77 doesnt work.

Maybe you have another suggestion?

0 Karma

MuS
SplunkTrust
SplunkTrust

sure there are more suggestions; like streamstats .... take a look at this blog post http://blogs.splunk.com/2013/10/31/streamstats-example/ to get an idea how to use it

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...