topic Re: Only Listing Transactions with Multiple Events in Splunk Search

Only Listing Transactions with Multiple Events

epw0rrell — Thu, 18 Mar 2021 20:27:01 GMT

I am interested in only listing transactions of a given source entity that contain multiple events. Is there a quick and easy way to do this?

index=main | transaction src_entity startswith=at least one thing endswith=another thing | table src dst etc.

Re: Only Listing Transactions with Multiple Events

bowesmana — Thu, 18 Mar 2021 20:59:24 GMT

If you're just looking for number of events that make up the transaction, then the transaction command adds a field called eventcount to each of the results, so you can just do

| where eventcount>1

Please note that transaction command has a number of issues when dealing with large data sets or long running spans between connected events and you will not see errors when using the command, only 'odd' things happening and random behaviour.

transaction has its uses, but often the same can be achieved with the stats command

Re: Only Listing Transactions with Multiple Events

epw0rrell — Thu, 18 Mar 2021 21:03:56 GMT

Thanks, that is definitely the answer to that question but now looking at the results, I see that I need to be more specific and only display transactions where a certain field has more than one "event" value if that makes sense? Thanks for your help and is there a way I can do this?

Re: Only Listing Transactions with Multiple Events

bowesmana — Fri, 19 Mar 2021 05:12:55 GMT

To count multiple values of fields, use mvcount, i.e.

| where mvcount(fieldname)>1

and a 'value' in the field will be the set of distinct values found for that field in the transaction, e.g. see this simple example

Re: Only Listing Transactions with Multiple Events

epw0rrell — Fri, 19 Mar 2021 15:15:00 GMT

Work perfect thanks!!