topic Can you search for two strings in chronological order (in different log statements)? in Splunk Search

Can you search for two strings in chronological order (in different log statements)?

jbrenner — Mon, 14 Aug 2017 20:14:04 GMT

In every log statement, we write the user's session ID delimited by hyphens as follows:

 -S:ybiSmNiQxF-

I want to get a count of session IDs that contain two specific message strings (in separate log statements) in a specific order. I don't care if there are intervening log statements.

Example:

2017-08-11 12:51:57,918 INFO - whatever-S:ybiBmNiQxF-whatever STATEMENT1 whatever 
2017-08-11 12:51:57,921 INFO - whatever-S:ybiBmNiQxF-whatever STATEMENT2 whatever

Is there a way to do this in a Splunk query?

Thanks,
Jonathan

Re: Can you search for two strings in chronological order (in different log statements)?

cpetterborg — Mon, 14 Aug 2017 20:28:56 GMT

Is the sessionID already extracted into a field? If so, then you can use the transaction command to combine the sets of transactions (same sessionID) together and perform functions on those, whether it be counts, check for completed transactions, etc.

If it is not already extracted, then you will have to do a field extraction (either automatic or inline) to use the transaction command. For that you may have to provide more complete example data in order to allow us to help with the field extraction.

Re: Can you search for two strings in chronological order (in different log statements)?

somesoni2 — Mon, 14 Aug 2017 20:52:12 GMT

Give this a try (assuming no field extraction was done, if it has, remove the rex commands)

your base search for selecting only STATEMENT1 and STATEMENT2 type of events
| rex "S:(?<sessionID>[^\-]+)\S+\s+(?<Statement>\S+)"
| stats list(Statement) as Statements by sessionID 
| where mvindex(Statements,0)="STATEMENT1" AND mvindex(Statements,1)="STATEMENT2" | stats count

Re: Can you search for two strings in chronological order (in different log statements)?

jbrenner — Wed, 23 Aug 2017 15:02:32 GMT

Thanks for pointing me in the right direction. SInce there did not turn out to be any intervening events, I was able to use maxevents=2 with the TRANSACTION command:

index=my_index
            | rex field=_raw "-S:(?<SESSION_ID>\w+)-" | transaction SESSION_ID startswith="STATEMENT1" endswith="STATEMENT2" maxevents=2