topic Re: Make Transaction wait or End before Starting new transaction in Splunk Search

Is there a way to make transaction wait or end before starting new transaction?

morganj1 — Mon, 30 May 2022 23:26:12 GMT

Hi, is there a way to make a Splunk transaction wait until it has ended, before starting another transaction.

e.g. if I have (with latest results at the top)

a	end
b	start
c	start
d	end
e	end
f	start
g	start
h	start

What I get from Splunk here would be transactions: f->e, g->d and b->a.

But what I want is h->e and c->a, so once it's found "start" it then looks for "end", and then looks for the next "start" after that... etc.

Re: Make Transaction wait or End before Starting new transaction

gcusello — Mon, 30 May 2022 12:09:02 GMT

Hi @morganj1,

it's possible if you have a field (e.g. transaction_id) to use as a correlation key to correlate events, if you use startswith and/or endswith options it isn't possible.

Anyway, if you have a field to use as key, see a different approach using the stats command instead transaction because the thansaction command is very slow!

Ciao.

Giuseppe

Re: Make Transaction wait or End before Starting new transaction

PickleRick — Mon, 30 May 2022 12:27:39 GMT

You could also try to transform your data so that it keeps only the first "start" in a row (by using autoregress/streamstats to get previous value and only leave the "start" if it was preceeded by an "end")

Re: Make Transaction wait or End before Starting new transaction

yuanliu — Mon, 30 May 2022 18:59:08 GMT

If you are sure that those 'in-between' events are useless, you can even use dedup to filter them out.