topic Re: Am I using the transaction command correctly? in Splunk Search

Am I using the transaction command correctly?

Craigrow — Tue, 26 Nov 2013 22:44:43 GMT

I have a log which is tracking objects as they get moved around by a state machine. The log records a timestamp, the GUID of the object that was moved and the to and from states for the object.

When the state machine moves object to state=foo, this is the beginning of the transaction I want to see. Then the object will then cycle between states foo and bar for some time. Eventually they leave state=foo and go to a state other than foo or bar. That is the end of the transaction.

This is the search that I wrote. When I look at these transactions I'm not seeing what I expected. Am I doing this correctly?

transaction ObjectGUID startswith(ToState=foo AND FromState!=bar) endswith(FromState=foo AND ToState!=bar)

Re: Am I using the transaction command correctly?

_d_ — Wed, 27 Nov 2013 00:41:33 GMT

You're missing equal signs. startswith and endswith options need to be followed by =

Example dataset:

Tue Nov 26 19:25:51 EST 2013 ToState=foo FromState=qux objectGUID=abc Tue Nov 26 19:25:52 EST 2013 ToState=bar objectGUID=abc Tue Nov 26 19:25:53 EST 2013 ToState=foo objectGUID=abc Tue Nov 26 19:25:54 EST 2013 ToState=bar objectGUID=abc Tue Nov 26 19:25:55 EST 2013 ToState=foo objectGUID=abc Tue Nov 26 19:25:56 EST 2013 ToState=baz FromState=foo objectGUID=abc Tue Nov 26 19:25:57 EST 2013 ToState=qux objectGUID=abc Tue Nov 26 19:25:58 EST 2013 ToState=baz objectGUID=abc Tue Nov 26 19:25:59 EST 2013 ToState=qux objectGUID=abc Tue Nov 26 19:26:00 EST 2013 ToState=baz objectGUID=abc Tue Nov 26 19:26:01 EST 2013 ToState=qux objectGUID=abc Tue Nov 26 19:26:02 EST 2013 ToState=baz objectGUID=abc

index=main | transaction objectGUID startswith=(ToState=foo AND FromState!=bar) endswith=(FromState=foo AND ToState!=bar)

Results:

Tue Nov 26 19:25:51 EST 2013 ToState=foo FromState=qux objectGUID=abc Tue Nov 26 19:25:52 EST 2013 ToState=bar objectGUID=abc Tue Nov 26 19:25:53 EST 2013 ToState=foo objectGUID=abc Tue Nov 26 19:25:54 EST 2013 ToState=bar objectGUID=abc Tue Nov 26 19:25:55 EST 2013 ToState=foo objectGUID=abc Tue Nov 26 19:25:56 EST 2013 ToState=baz FromState=foo objectGUID=abc

Re: Am I using the transaction command correctly?

Craigrow — Wed, 27 Nov 2013 17:11:33 GMT

Got it. Thanks!

Re: Am I using the transaction command correctly?

Craigrow — Wed, 27 Nov 2013 17:11:50 GMT

Got it. Thanks!

Re: Am I using the transaction command correctly?

yannK — Fri, 29 Nov 2013 01:25:03 GMT

Hi Craig, it your question was answered, please check the "accept" icon, it will help the other user to find useful information and reward the person that answered.