topic Counting sessions with missing events in Splunk Search

Counting sessions with missing events

ShagVT — Fri, 23 Apr 2021 14:54:54 GMT

Hey gang - searching for missing data is probably the weakest part of my Splunk skillset. I just have a hard time thinking through how to even write such a query.

I have a transaction that usually goes event_name=A, event_name=B, event_name=C. But I'm trying to research a situation where B is missing sometimes. I'd like to be able to build a timechart that shows the number of transactions in which B is missing. The events in transaction are all linked by a common identifier that we'll call session_id.

I've looked at the transaction command and I suppose I understand that.

index=indexname event_name=A OR event_name=B OR event_name=C | transaction session_id startsWith=A endsWith=C maxspan=10m

But I don't know where to go from here.

Re: Counting sessions with missing events

ITWhisperer — Fri, 23 Apr 2021 15:07:38 GMT

Assuming that session_id is unique across transactions, this will tell you when a transaction with fewer than 3 unique events started and finished

index=indexname event_name=A OR event_name=B OR event_name=C | stats dc(event_name) as events earliest(_time) as start latest(_time) as end by session_id | where events < 3

If you specifically want the check event B, you could

index=indexname event_name=A OR event_name=B OR event_name=C | stats values(event_name) as events earliest(_time) as start latest(_time) as end by session_id | where isnull(mvfind(events,"B"))

Re: Counting sessions with missing events

ShagVT — Fri, 23 Apr 2021 16:43:45 GMT

Your second query here is basically what I was looking for. To make it work as a timechart I ended up doing this:

index=indexname event_name=A OR event_name=B OR event_name=C | stats values(event_name) as events earliest(_time) as start latest(_time) as end by session_id | where isnull(mvfind(events,"B")) | eval _time=start | timechart count

THANK YOU!!!