Splunk Search

Matching the last instance of "endswith" in a transaction?

lisa_1
Explorer

The transaction command matches only the first instance of the specified endswith, however it's possible and likely that the transaction doesn't actually end there. Transaction should match on the last instance, but it doesn't.

Is there a workaround for it? Consider a simple example:


ticket=4000 transaction_type="Create" ticket_status="new"
ticket=4000 transactioon_type="Status" ticket_status="open"
ticket=4000 transaction_type="Status" ticket_status="resolved"
ticket=4000 transactioon_type="Status" ticket_status="open"
ticket=4000 transaction_type="Status" ticket_status="resolved"

As you can see the ticket is opened once (startswith=Create) but resolved twice with someone reopening the ticket in between. A simple endswith=resolved will miss the true resolution of the ticket and all kinds of metrics will be wrong.

Is there a way to workaround this limitation and capture the final ticket_status="resolved" as the true end of the transaction for ticket=4000?

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

In this case, do you need to use startswith or endswith at all? Can you simply transaction (or stats) on ticket alone?


Updated:

If you need to know just the last state and time, you can do either:

ticket=* | transaction ticket mvlist=ticket_status | where mvindex(ticket_status,-1)=="resolved" | eval lastresolvedtime=_time+duration

or

ticket=* | stats last(ticket_status) as last_status,first(_time) as start_time,last(_time) as end_time by ticket | where last_status=="resolved
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

updated answer

0 Karma

lisa_1
Explorer

One issue is that we have to know that the final status is resolved. Using a transaction may find the ticket simply in the open state or any other non-resolved state. So unfortunately we're forced into knowing the create time and deducing the last resolved time.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I wouldn't use endswith, since you want all events following "startswith".

How about: |transaction startswith=Create ticket|stats last(ticket_status) by ticket?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...