topic Re: Filtering Hosts within a Transaction in Splunk Search

Filtering Hosts within a Transaction

tbrown — Thu, 30 Jul 2020 17:00:09 GMT

So I have a search that is structured as follows

index=main <filtering for start and end events> OR <filtering for events within start and end events> | rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..." | transaction startswith="..." endswith="..."

The rex fields work, the transaction works, etc. However, In the events within the transaction, it pulls from every host that fits the filtering. Basically, I want to limit the transaction to only include the hosts that are listed in the Falling_Node and Rising_Node fields. I've tried adding "host=Falling_Node OR host=Rising_Node" in the "filtering for events within start and end events" but it either clears all events out of the transaction or does nothing.

Does anyone have tips?

Re: Filtering Hosts within a Transaction

richgalloway — Thu, 30 Jul 2020 17:12:19 GMT

You can tell the transaction command to use fields when matching up events. Something like this

Re: Filtering Hosts within a Transaction

tbrown — Thu, 30 Jul 2020 19:56:24 GMT

@richgalloway

That would be a good solution, however only one event (the last event) in my transactions actually contain the fields "Rising_Node" and "Falling_Node". That means that I can't sort the transaction like you mentioned because it would never find the "startswith" event to make the transactions. Do you have any alternative solutions?

Re: Filtering Hosts within a Transaction

richgalloway — Thu, 30 Jul 2020 20:19:09 GMT

Perhaps this?

Re: Filtering Hosts within a Transaction

tbrown — Thu, 30 Jul 2020 21:15:07 GMT

@richgalloway Unfortunately that didn't work either and it returns no results.