Splunk Search

Conditional field based on transaction

kbaden
Explorer

Hi

I am currently using transaction to generate a report on length of user session, which is working well. The next iteration is to remove the time the computer is idle [ Windows goes to sleep after 30mins (1800 sec) at which point the event log is "The screen saver was invoked". So if that happens i need to remove 1800seconds from the timer.

Using the transaction i'm defining:
startswith=eval(match(_raw,"BROKER_LOGON"))
endswith=eval(match(_raw,"BROKER_LOGOFF") OR match(_raw,"The screen saver was invoked"))

I've currently created a field after the transaction "SessionLength", which is defined as duration/60 to show minute length.

I need to have something to the effect of:

IF Transaction closes with "The screen saver was invoked", SessionLength=((duration - 1800)/60)
ELSE SessionLength=(Duration/60)

This is to counter the lack of mouse movement over the last 1800seconds which leads to this event log. I've tried all sorts of IF, CASE... but don't know how reference the last event/message in a transaction. Even if I can say that IF contains "The screen..." then do this, else do that - would be sufficient.

Still relatively new to Splunk, tried exploring for days before posting. Any thoughts?

Example:
eval SessionLength(minutes)=if(transaction = "The screen saver was invoked", ((duration - 1800)/60),(duration/60))
so if the transaction is "The screen.." the field equals duration - 1800 then divided by 60. If it doesnt contain the statement its just duration divided by 60.

0 Karma
1 Solution

sundareshr
Legend

You don't need the transaction command for this. Try using stats instead, like this...

base search | eval status=case(match(_raw, "BROKER_LOGON"), "LogOn", match(_raw, "BROKER_LOGOFF"), "LogOff", match(_raw, "screen saver was invoked"), "ScreenSaver", 1=1, "Unknown") | chart earliest(_time) over transaction_id by status | eval SessionLength=case(isnull(Screensaver), (LogOff-LogOn)/60, isnotnull(ScreenSaver), ((duration - 1800)/60), 1=1, 0) | eval SessionLength=tostring(SessionLength, "duration")

View solution in original post

sundareshr
Legend

You don't need the transaction command for this. Try using stats instead, like this...

base search | eval status=case(match(_raw, "BROKER_LOGON"), "LogOn", match(_raw, "BROKER_LOGOFF"), "LogOff", match(_raw, "screen saver was invoked"), "ScreenSaver", 1=1, "Unknown") | chart earliest(_time) over transaction_id by status | eval SessionLength=case(isnull(Screensaver), (LogOff-LogOn)/60, isnotnull(ScreenSaver), ((duration - 1800)/60), 1=1, 0) | eval SessionLength=tostring(SessionLength, "duration")

kbaden
Explorer

Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...