topic Re: How do I filter a transaction search based on the number of events in each transaction? in Splunk Search

How do I filter a transaction search based on the number of events in each transaction?

MikeRose — Thu, 06 Sep 2012 05:19:31 GMT

I want to group search results by user & src_ip (eg. via "transaction) however I only want to display results where there is more than x events per transaction. I can't find in the documentation whether the transaction grouping creates any variable I can then subsequently filter on.

Eg.

index=os sourcetype=syslog process=sshd Invalid | transaction user src_ip | ...?

Re: How do I filter a transaction search based on the number of events in each transaction?

MuS — Thu, 06 Sep 2012 05:43:16 GMT

Hi MikeRose

after a transaction, all the transaction fields are merged into a single field.
only one is kept, if they are the same. if they are different, they are all concatenated.

example

search * | eval raw=_raw | table host source source_IP raw hostA sourceA 
192.168.168.73 "myrawevent" hostA sourceA  192.168.168.10 "mysecondrawevent"

becomes the transastion

search | transaction | eval raw=_raw | table host source source_IP raw hostA
 sourceA "192.168.168.73 192.168.198.10" "myrawevent mysecondrawevent"

so you may want to filter using wildcards, like

index=os sourcetype=syslog process=sshd Invalid | transaction user src_ip | WHERE src_ip="*192.168.168.73*"

index=os sourcetype=syslog process=sshd Invalid | transaction user src_ip | WHERE like(src_ip,"%192.168.168.73%")

index=os sourcetype=syslog process=sshd Invalid | transaction user src_ip |search src_ip="*192.168.168.73*"

cheers,

MuS

Re: How do I filter a transaction search based on the number of events in each transaction?

MikeRose — Thu, 06 Sep 2012 05:46:04 GMT

Found it:

index=os sourcetype=syslog process=sshd Invalid | transaction user src_ip | search eventcount>1

Re: How do I filter a transaction search based on the number of events in each transaction?

MikeRose — Thu, 06 Sep 2012 05:47:05 GMT

I think you misunderstood me. Your suggestions are not helpful. I wanted to filter the resulting list of transactions based on the number of events per transaction

Re: How do I filter a transaction search based on the number of events in each transaction?

MuS — Thu, 06 Sep 2012 06:24:57 GMT

wow, bad day today? I was just trying to help and explain how the fields are handled in transaction.

Re: How do I filter a transaction search based on the number of events in each transaction?

MikeRose — Wed, 12 Sep 2012 04:08:18 GMT

There is no need to take it personally or get upset, I was being objective. I down-voted your answer because it was not useful and didn't address the question. As you can see ("...where there is more than x events per transaction"), my original question is about filtering transactions by number of events, not how fields are handled in transactions. I wasn't passing judgement on you personally.

Re: How do I filter a transaction search based on the number of events in each transaction?

MuS — Wed, 12 Sep 2012 05:45:36 GMT

Hi MikeRose
for two reasons, my answer was useful.
1. if you don't know what happens to fields in transactions, you are not able to 'filter' anything.
2. One of my examples provided the solution for you 😉

cheers,
MuS