How to Use Field Values in Endswith Parameter of Transactions

Traer001 — Fri, 23 Apr 2021 21:08:45 GMT

Hello!

I am trying to group my log entries based on very specific criteria but can't seem to figure out how to do so.

I have logs like this:

2021-04-23 16:47:26 User Id: 6211 Error Resolved

2021-04-23 16:47:25 Error[0] type 800

2021-04-23 16:47:25 User Id: 2345 Error Resolved

2021-04-23 16:47:23 Error[0] Error Response {"user_id":2345, "error_id":9101, ..............etc}

2021-04-23 16:47:23 Error[0] type 800

2021-04-23 16:47:22 Error[0] Error Response {"user_id":6211, "error_id":9100, ..............etc}

2021-04-23 16:47:22 Error[0] type 800

I am trying to get three events in my transactions: (1) the initial error type message, (2) the error response details, and (3) the error resolved message. However, I need the error response details and the error resolved message to contain the same user id. I currently have my query set up like this:

index=INDEX host=HOSTNAME sourcetype=SOURCETYPE
| rex field=_raw "Error\[0\]\stype\s(?<error_code>\d+)"
| rex field=_raw "User\sId:(?<user_id>\d+)\sError\sResolved"
| rex field=_raw "Error\[0\]\sError\sResponse\s{\"user_id\":(?<user_id>\d+)"
| where user_id<20000 or error_code=800
| transaction startswith="Error[0] type 800" endswith="User Id:"

I'm lost on how to make sure that the transaction retrieves only the events where the user id of the error response details matches the error resolved message. Any ideas?

topic How to Use Field Values in Endswith Parameter of Transactions in Splunk Search

How to Use Field Values in Endswith Parameter of Transactions