https://community.splunk.com/t5/Splunk-Search/Comparing-two-consecutive-events/m-p/271230#M176789 <P>I'm assuming you have the name of the process extracted into a <CODE>process</CODE> field, and that there are no overlapping instances of any one process.</P> <PRE><CODE> index=myIndex sourcetype=applogs process=* (Started OR Completed OR Terminated) | transaction process startswith=Started endswith=(Completed OR Terminated) </CODE></PRE> <P>Mild disclaimer: Didn't test if the endswith condition is correct syntax, see <A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction</A> to make it work for your specific events.</P> <P>That will stitch together the start and end events, and give you a <CODE>duration</CODE> field per process run. By examining the events for "Completed" or "Terminated" you can tell if the run was successful or not.</P> <P>If the assumption of "no overlapping runs" does not hold you need unique IDs to link each start and end event together, and run the <CODE>transaction</CODE> command on that ID field.</P> Fri, 09 Sep 2016 12:42:06 GMT martin_mueller 2016-09-09T12:42:06Z https://community.splunk.com/t5/Splunk-Search/Comparing-two-consecutive-events/m-p/271229#M176788 <P>Hello all,</P> <P>I am trying to evaluate my process using two consecutive events and know whether my process succeeded or failed. My log is set up as below:<BR /> 1. When process is started, I get - #Timestamp# Started MyProcess <BR /> 2. When process is completed successfully, I get - #Timestamp# Completed MyProcess <BR /> 3. If it fails, I get - #Timestamp# Terminated MyProcess</P> <P>The process usually takes a minute or so. I would like to query and find out whether the process has succeeded or failed and also, how long it took. For the immediate (my process runs many times in a day and so I need to compare only the immediate/ consecutive entries) combination of Started and Completed, the status should be success, whereas for Started and Terminated, the status should be Failed.</P> <P>My base query is like:<BR /> index=myIndex sourcetype = applogs "Started MyProcess " Or "Completed MyProcess" Or "Terminated MyProcess"</P> <P>Any help would be highly appreciated! Thanks much!</P> <P>Cheers!</P> <P>PS</P> Fri, 09 Sep 2016 10:59:00 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-two-consecutive-events/m-p/271229#M176788 Parse 2016-09-09T10:59:00Z https://community.splunk.com/t5/Splunk-Search/Comparing-two-consecutive-events/m-p/271230#M176789 <P>I'm assuming you have the name of the process extracted into a <CODE>process</CODE> field, and that there are no overlapping instances of any one process.</P> <PRE><CODE> index=myIndex sourcetype=applogs process=* (Started OR Completed OR Terminated) | transaction process startswith=Started endswith=(Completed OR Terminated) </CODE></PRE> <P>Mild disclaimer: Didn't test if the endswith condition is correct syntax, see <A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction</A> to make it work for your specific events.</P> <P>That will stitch together the start and end events, and give you a <CODE>duration</CODE> field per process run. By examining the events for "Completed" or "Terminated" you can tell if the run was successful or not.</P> <P>If the assumption of "no overlapping runs" does not hold you need unique IDs to link each start and end event together, and run the <CODE>transaction</CODE> command on that ID field.</P> Fri, 09 Sep 2016 12:42:06 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-two-consecutive-events/m-p/271230#M176789 martin_mueller 2016-09-09T12:42:06Z