Splunk Search

Why my transaction command takes wrong event

SridharS
Path Finder

I am trying to determine the outage duration of a network device . I use the transaction command for this. My device goes down and comes back live say for every other hour. But my transaction command is only considering the first downtime as START and last uptime as END, due to this I am not able to determine the actual outage hours . Is there a way to make my transaction command understand how to calculate by checking every downtime and uptime events.

Example: My device goes down at 1am and comes live at 2am. Again goes down at 3am and comes live at 4am.
My transaction command calculates the downtime as 1am and uptime as 4am.

So the actual total outage hours is 2hrs (1am-2am and 3am-4am) but my transaction command calculates it as 3hrs (1am-4am).

my command is | transaction host startswith=(devicestatus="Down") endswith=(devicestatus="Up") maxspan=7d

Thanks in advance..

Tags (2)
0 Karma

pranav_agile
Explorer

Try mvexpand that is well explained in the below link:
https://answers.splunk.com/answers/37766/transaction-with-mvexpand.html

0 Karma

inventsekar
Ultra Champion

i uploaded these sample events -

testlog devicestatus="Down" time=1am 
testlog devicestatus="Up" time=2am
testlog devicestatus="Down" time=3am 
testlog devicestatus="Up" time=4am
testlog devicestatus="Down" time=7am 
testlog devicestatus="Up" time=8am

and transaction seems working fine..
how you calculate the outage hours.. please write the full command and maybe, post some sample events..
alt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...