Splunk Search

How do I merge events on the basis of time and fields?

pratibha2018
Explorer

I want to merge events that are in between state=" STARTED" and state="COMPLETED" i.e. All the following events of state="STARTED" and preceding to state="COMPLETED" will merge into a single event.

0 Karma

tiagofbmm
Influencer

Hey

Do you have any field that may connect those events? Like an ID?

Then you could use transaction command with these parameters

endswith
Syntax: endswith=<filter-string>
Description: A search or eval expression which, if satisfied by an event, marks the end of a transaction.

startswith
Syntax: startswith=<filter-string>
Description: A search or eval filtering expression which if satisfied by an event marks the beginning of a new transaction.

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction

0 Karma

pratibha2018
Explorer

No Nothing to match.

0 Karma

tiagofbmm
Influencer

Well and to you have events starting in between the others?

I mean:

event A started at X and ended at Y
event B starter at X+5 and ended at Y+3

Do you also have those scenarios?

0 Karma

pratibha2018
Explorer

There is the start time for each event, not the end time. And also not necessary that the event B start at X+5 .

So, In my case eventA gives me the log that Request1 started for user1
eventB gives me that Request2 has completed in time(* sec) for user2
And If there is any Error then another EventC is created in between A and B with Error log.
Now, I just want table "Error log" User.

Is this possible??

0 Karma

tiagofbmm
Influencer

I don't see that possible if you don't have an element to trace the events back.

Can you show us a piece of your log with the events you mentioned?

0 Karma

pratibha2018
Explorer

Here's the code :

2018-02-09 18:10:25,542 INFO [qtp1687849576-8861]: "class name1" - [#0000e4ca] "Request1" from "ip_address1" ("email_id1") STARTED
2018-03-09 18:10:26,610 ERROR [qtp1687849576-12683]: "class name2" - Cannot retrieve. No UserLoginHistory information is stored.
2018-02-09 18:10:28,760 INFO [qtp1687849576-8861]: "class name1" - [#0000e4ca] "Request1" from "ip_address1"("email_id1") COMPLETED in 0.217s

0 Karma

p_gurav
Champion

Did you extract this "qtp1687849576" into field say abc and then
Can you try :

| transaction abc startswith="STARTED" endswith="COMPLETED"

0 Karma

pratibha2018
Explorer

Thanks @p_gurav
But can't rely on this "qtp..." thing.

0 Karma

p_gurav
Champion

Is there any other common field present in logs?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...