topic Re: How do you find consecutive events in two different searches? in Splunk Search

How do you find consecutive events in two different searches?

funnysage — Tue, 29 Sep 2020 22:44:05 GMT

Hi,

This is a newbie question.

I have two different searches. I want to combine the search results and only display a result where a certain event appears before another result.

For e.g.

Search1 : sourcetype=SourceType_A "Some str 1"
Search2 : sourcetype=SourceType_B "Some str 2"

Result set should be:
Some str 2
Some str 1

So I want to show only those instances where "Some str 1" is followed by "Some str 2" and time gap in within say 3 secs.

Re: How do you find consecutive events in two different searches?

bangalorep — Thu, 10 Jan 2019 09:33:28 GMT

Hello,
You can use the transaction command.
So essentially a search like (sourcetype=SourceType_A "Some str 1") OR (sourcetype=SourceType_B "Some str 2") will get the events in the same search.
You can then use the transaction command based on whats common among the events and use the maxspan option to specify the time gap you want.
Here is the documentation for the transaction command https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Transaction

Re: How do you find consecutive events in two different searches?

funnysage — Thu, 10 Jan 2019 23:02:30 GMT

Hi There,

Thanks for the feedback.
I used this criteria: (sourcetype=SourceType_A "Some str 1") OR (sourcetype=SourceType_B "Some str 2")|transaction maxspan=5s.
Using this i was able to group together the series of events that i was interested in. However, i am getting some extra events. My output looks something like this:

"Some str 1"
"Some str 1"
"Some str 1" <- event group that i am interested. I wanted this group as the output.
"Some str 2"
"Some str 1"

Re: How do you find consecutive events in two different searches?

bangalorep — Fri, 11 Jan 2019 04:59:01 GMT

You can use the startswith and endswith option as well.
So your transaction command should look something like |transaction maxspan=5s startswith="some str 1" endswith = "some str 2"

Re: How do you find consecutive events in two different searches?

nareshinsvu — Fri, 11 Jan 2019 05:54:39 GMT

Check out below thread. I had similar query resolved using transaction command

https://answers.splunk.com/answers/714361/how-do-you-group-start-and-end-times-from-a-set-of.html

Re: How do you find consecutive events in two different searches?

funnysage — Fri, 11 Jan 2019 06:04:29 GMT

This works perfectly. Thanks.