topic Status of a transaction using splunk transaction command in Splunk Search

Status of a transaction using splunk transaction command

ayush-choudhary — Mon, 21 Mar 2022 10:42:34 GMT

i am using transaction command to check the start time and end time of a transaction.

I have used:

| transaction TxnId startswith="NEW TXN" endswith= "statusY" keeporphans=true | eval starttime=_time | eval endtime=_time+duration | eval starttime=strftime('starttime', "%Y-%m-%d %H:%M:%S.%3N") | eval endtime=strftime('endtime', "%Y-%m-%d %H:%M:%S.%3N") | table TxnId starttime endtime

I want to check if all transactions have start time and end time for the success rate. Now even if the endswith="statusY" is not there, it is calculating its end time.

What can i do to make sure there should be no end time if the condition endswith="statusY" is not there. And if the condition of both startswith and endswith is met table should show status as success or else blank.

Re: Status of a transaction using splunk transaction command

gcusello — Mon, 21 Mar 2022 10:48:58 GMT

Hi @ayush-choudhary,

the transaction command is a very slow and expensive command, please try a different approach:

your_search ("NEW TXN" OR "statusY") | stats earliest(_time) AS starttime latest(_time) AS endtime BY TxnId | eval starttime=strftime('starttime', "%Y-%m-%d %H:%M:%S.%3N"), endtime=strftime('endtime', "%Y-%m-%d %H:%M:%S.%3N") | table TxnId starttime endtime

This approach is possible when you have an ID to use to group events.

Ciao.

Giuseppe

Re: Status of a transaction using splunk transaction command

ayush-choudhary — Mon, 21 Mar 2022 10:57:24 GMT

@gcusello

thanks, but with this query as well i am getting an endtime for a TxnId for with there is no "statusY"
i am finding something with can show me no value for endtime for a TxnId that do not have "statusY".

Re: Status of a transaction using splunk transaction command

gcusello — Mon, 21 Mar 2022 11:11:03 GMT

Hi, ok, please try this:

your_search ("NEW TXN" OR "statusY") | stats earliest(_time) AS starttime latest(_time) AS endtime count BY TxnId | eval status=case(count=2,"Both present",searchmatch("NEW TXN"),"Only NEW TXN",searchmatch("statusY"),"Only statusY"), starttime=strftime('starttime', "%Y-%m-%d %H:%M:%S.%3N"), endtime=strftime('endtime', "%Y-%m-%d %H:%M:%S.%3N") | table TxnId starttime endtime status

in this way you can identify all the conditions and take only the ones you want.

Ciao.

Giuseppe