Splunk Search

Finding paired events that are out of sequence (missequenced) or missing partner events

woodcock
Esteemed Legend

We have a system that generates user-level start and stop event logs. Assume all events have a userID and sessionID and that start events have type=Start and stop events have type=Stop, how do I find/count transactions where there are multiple start events for a user without a stop event in-between them. Normally the start and stop events would be minutes apart but in this error scenario what we are seeing is the system generating multiple start events very close together in time. Sometimes the latter (duplicate but not identical) start events prevent the previous start events from ever getting the matching stop event (StartA, StartB, StopB) but other times we will see full pairing (StartA, StartB, StopB, StopA OR StartA, StartB, StopA, StopB). The normal sequence is StartA, StopA, StartB, StopB.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

This will do it:

... | streamstats usecurrent=f last(type) AS prevType BY userid, sessionid | where type="Start" AND prevType="Start"

View solution in original post

0 Karma

woodcock
Esteemed Legend

This will do it:

... | streamstats usecurrent=f last(type) AS prevType BY userid, sessionid | where type="Start" AND prevType="Start"
0 Karma

woodcock
Esteemed Legend

There are many users so the same users show up in many events but each Start/Stop pair of events will share a unique-to-the-pair (across all events and users) sessionID. A users may only have 1 session at a time. The ideal search would show every time there are 2 starts (for a particular user) without a stop between them; that should be enough.

kristian_kolb
Ultra Champion

what would your sessionID's be like (in each event) for the StartA-StartB-StopA-StopB scenario?

Just what do you want your search/report to show?

/k

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...