Splunk Search

Using subsearch?

shangshin
Builder

Hi,
I have a log file with 3 columns, timestamp, processID and state. When the process starts or ends, a row is inserted into the log file. What's the best search string to find out all jobs in start state?

Thanks in advance!

time PID   State 
9:22 1000  start
9:23 2000  start
9:24 3000  start
9:25 4000  start
9:26 5000  start
9:37 2000  end
9:38 4000  end
9:39 6000  start
9:40 7000  start
9:41 5000  end
Tags (1)
0 Karma
1 Solution

Ayn
Legend

I don't think a subsearch would be of any use in your scenario. Rather I'd advise you to use transaction or stats. Both can be used to group events by PID and then show you the groups that have a start event but no end event.

Using stats, it would be something like:

... | stats count,values(State) by PID | where count<2

And similarly, using transaction:

... | transaction PID | search eventcount<2

View solution in original post

Ayn
Legend

I don't think a subsearch would be of any use in your scenario. Rather I'd advise you to use transaction or stats. Both can be used to group events by PID and then show you the groups that have a start event but no end event.

Using stats, it would be something like:

... | stats count,values(State) by PID | where count<2

And similarly, using transaction:

... | transaction PID | search eventcount<2

shangshin
Builder

That's execellent. Thank you very much!

0 Karma

Ayn
Legend

Sure - the transaction command always produces two fields, eventcount and duration. We already used eventcount for the answer to your first question, and you could use duration for your second - it simply holds the duration, in seconds, of each transaction.

shangshin
Builder

I like the solution using transaction. Is there a way to find out the total traction time?
E.g. the PID 2000 took 14 minutes using the above sample log.

This will be very useful.

Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...