How can I find the reoccurring group of transactions over time?

[RocIngersol]

Hey Folks,

I have a transaction search that "groups" various things of interest (5m maxspan etc ). I was wondering - how could I count the reoccurrences of transaction groups over time? Some sort of eval I guess but ain't sure....

thx,
R

[aaraneta_splunk]

@RocIngersol - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

[woodcock]

Using transaction causes many metadata fields to be created including eventcount which is exactly what you need. Once the search completes, in the events area, to the left aligned with the the first line of each transaction, in the i column, you should see a > character. Click on this and it will become a v character. Then scroll down to the bottom of your event to see a wonderful land of insight showing each field/value that exists for this event, even the uninteresting ones.

[DalJeanis]

Can you give a specific example of what you would call a recurrence? That description or example is going to determine how you need to treat the data in order to be able to find that recurrence.

[RocIngersol]

Sure, thx. So my transaction search runs and I get lots of "grouped events" by my criteria and max span etc. So while that's valuable I want to count the occurrences of each transaction group over time. I tried building a new field after transaction with eval newIDfield=field1+field2 But that results in some newIDfield being blank when there are multiple different values for field1 out of the transaction..

Hope that is clearer! I'll post my search when I'm online later if not.

R

[DalJeanis]

The search itself would help. The main question is, how do you (as a data consumer) know that a later transaction is a recurrence of an earlier one, as opposed to a closely similar but different transaction?

[woodcock]

You probably need timechart, maybe ... | timechart count BY host added to your existing search.