topic Re: Find duration on transaction where field name doesn't match in Splunk Search

Find duration on transaction where field name doesn't match

pkcbailey — Tue, 28 May 2019 16:44:34 GMT

Sample data:

May 25 01:51:14 ns1 named[32063]: zone somezone.net/IN/default: notify from 192.168.10.20#31830: serial 558310538
May 25 03:16:17 ns1 named[32063]: zone somezone.net/IN/default: transferred serial 558310538: TSIG 'view12345'

My issue is, without using the serial number which I've not been able to map to the same field name, the data won't be tracked correctly in a transaction. I get transactions with serial number that don't match. I need to know how long it took the DNS to notify then transfer somezone.net for the same exact serial number.

Re: Find duration on transaction where field name doesn't match

pkcbailey — Tue, 28 May 2019 16:47:04 GMT

Here was the query I started with: index=dns host=ns1 ((notify AND serial) OR serial) somezone.net |transaction zonename startswith=notify endswith=transferred |where duration>600 |table duration

Re: Find duration on transaction where field name doesn't match

jodyfsu — Tue, 28 May 2019 18:22:52 GMT

Before we address the transaction, you say, "without using the serial number which I've not been able to map to the same field name,"...

Will a rex not work to get you the serial number, then you could use the serial number for the transaction?

Re: Find duration on transaction where field name doesn't match

pkcbailey — Tue, 28 May 2019 19:01:46 GMT

I'm not sure how to rex that into a single value.

Re: Find duration on transaction where field name doesn't match

jodyfsu — Tue, 28 May 2019 19:14:02 GMT

Does this work:

|rex "serial\s(?<SERIALNUMB>\d+)"

Re: Find duration on transaction where field name doesn't match

pkcbailey — Wed, 29 May 2019 13:56:50 GMT

None of the rex code folks have provided group the transaction with the same serial number yet.

Re: Find duration on transaction where field name doesn't match

aromanauskas — Sun, 02 Jun 2019 17:17:58 GMT

Try this:

index=dns host=ns1 ((notify AND serial) OR serial) somezone.net |rex "\s+serial\s+(?<serial_test>\d+)" | transaction serial_test,zonename max_events=2  startswith=notify endswith=transferred| where duration>600 |table duration