Splunk Search

How to get transaction to ignore endswith if startswith doesn't exist

mikecal
Explorer

I have an issue where my transaction search finds endswith events with no startswith events.

Not to go into too much detail but this is due to a funky way that Cisco logs OSPF events when DMVPN is involved.

I want to simply ignore endswith matches if a startswith event doesn't exist.

Is there a way to force transaction to only match if a startswith event exists (must startswith)?

Below is my search:

sourcetype=cisco:ios eventtype="cisco_ios-routing-ospf" | transaction host startswith="FULL to DOWN" endswith="LOADING to FULL" keepevicted=true | search closed_txn=0

Thanks,
Mike

0 Karma

woodcock
Esteemed Legend

Ditch transaction like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="cisco:ios" AND eventtype="cisco_ios-routing-ospf"
| streamstats count(eval(searchmatch(FULL to DOWN"))) AS sessionID
| streamstats count(eval(searchmatch(LOADING to FULL"))) AS endsWithPos BY sessionID
| eventstats count(eval(searchmatch(LOADING to FULL"))) AS endsWithCount BY sessionID
| search endsWithPos = endsWithCount
| stats rante(time) AS duration BY sessionID
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What are the values of the 'closed_txn' and '_txn_orphan' fields for the transactions missing startswith events? If the former is non-zero, add the keeporphans option to the transaction; if the latter is non-zero, use keepevicted=false.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mikecal
Explorer

Thanks for your reply. The value for keepevicted is non zero and for some reason keeporphans returns no value at. The problem I see with the keepevicted approach is that it cannot distinguish between startswith and endswith. I only want to ignore incomplete transactions where endswith is present with no startswith. However, I do want to know when a startswith value is found and no endswith value is found. When I set keepevicted to false, both endswith and startswith are ignored.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...