How to make transaction command take earliest event as startswith

power12 — Fri, 26 May 2023 22:21:54 GMT

Hello Splunkers ,

I am trying to build a query where I am using a transaction command which starts with MST and endswith Boot timestamp

| transaction host startswith="Starting MST" endswith="B timestamp:" maxspan=15m keepevicted=1

But in the raw events I have two events which starts with MST and I want to take the first one..but the transaction command takes the latest instead of earliest...how can I make the transaction command use earliest startswith event

2023-05-25T15:03:28.506750-07:00 ABC log-.sh[20252]: Starting MST (sftware) driver set

2023-05-25T15:03:38.455201-07:00 ABC log-.sh[22116]: Starting MST (sftware) driver set

2023-05-25T15:04:11.372010-07:00 ABC log-.sh[24041]: B timestamp: 2023-05-25 14:59:16

2023-05-25T15:04:11.367392-07:00 ABC log-.sh[24041]: SN: 16234567890

Thanks in Advance

Re: How to make transaction command take earliest event as startswith

richgalloway — Sat, 27 May 2023 00:33:14 GMT

That is the nature of transaction. Because it sees events in reverse time order, it assumes the first "MST" it sees (the latest one), is the one that it wants. There is no setting that changes that.

You may be able to use other fields to force it into picking another MST event. Perhaps the number in brackets can be used to pair the endswith with the right startswith.

topic Re: How to make transaction command take earliest event as startswith in Getting Data In

How to make transaction command take earliest event as startswith

Re: How to make transaction command take earliest event as startswith