How to perform advanced event correlation

[michael_bates_1]

Evening All,

I am currently collecting a feed of syslog messages from a RADIUS platform.
I need to be able to detect the condition where;

• A RADIUS start message is received (message A)
• Find the previous message for the IP address in message A (message B)
• Check if the RADIUS type in message B is not a STOP

I have been investigating transactions, but this does not seem able to capture the events that I need. Looked into streamstats, and this appears on the surface to be the correct function, but it does not return the correct results.

Search thus far;

index="radius" | streamstats current=f last(messageType) as previousType |
table _time,IP,messageType,sessionID,previousType

This is not returning the previous message for the IP in question. If I add the by clause to the streamstats command, the whole search stops returning results.

Any ideas/thoughts most welcome.

Michael Bates

[Ayn]

The streamstats command operates on events as they arrive as search results. Since Splunk searches by default return the most recent events first, that means that the last messageType value relative to an event is actually the one happening AFTER that event in time rather than before it. (This is not the case for real-time searches, as events arrive in chronological order.)

To have events return to streamstats in chronological order instead, just use reverse.

Other ways of finding the last messageType could include a combination of the map and localize commands for finding the "base event" and then search events in its vicinity to get other information, such as the previous messageType in your case. If you decide not to go for the streamstats approach, have a look at the docs for these commands: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Localize and http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map