topic Re: Eval a transaction with conditional statement in Splunk Search

Eval a transaction with conditional statement

aohls — Wed, 11 Sep 2019 17:17:31 GMT

I am using a transaction to group some jobs and get the timings. In doing so I want to check for certain steps, file download steps. I have the following.

| transaction unifyends=true JobID maxspan=12h | eval duration=round(duration/60, 2) | eval FTPDownload=if(like(_raw, "%FTPDownload%"), "Yes", "No")

In this case I want to check if the transaction itself contains FTPDownload, and set FTPDownload to Yes or No. I am at times getting both Yes and No, for the same job which does not change. Also for jobs I know and see there is an FTPDownload step, I am getting No back. Is _raw in this case only evaluating the first event in the transaction? Is there any issue with this approach I am overlooking? It seems like this should work but the results are not correct.

Re: Eval a transaction with conditional statement

somesoni2 — Wed, 11 Sep 2019 18:51:20 GMT

Try this

| transaction unifyends=true JobID maxspan=12h | eval duration=round(duration/60, 2) | eval FTPDownload=if(match(_raw, "FTPDownload"), "Yes", "No")

| eval FTPDownload=if(match(_raw, "FTPDownload"), "Yes", null()) | transaction unifyends=true JobID maxspan=12h | eval duration=round(duration/60, 2) | eval FTPDownload=coalesce(FTPDownload,"No")

Re: Eval a transaction with conditional statement

aohls — Thu, 12 Sep 2019 12:07:47 GMT

@somesoni2 The first one worked great. I attempted to use match very quickly but must have mistyped something along the way.