topic Re: How to write search to find number of Splunk transaction that start and end with certain condition? in Splunk Search

How to write search to find number of Splunk transaction that start and end with certain condition?

btcs2 — Tue, 14 Jun 2022 18:49:00 GMT

I need to find number of events that start with certain conditions and ends with certain condition .

example

index="*" source="*" | transacton startWith=C OR D endWith=A OR B

Need to find count ..

How to do it ?

Re: How to write search to find number of Splunk transaction that start and end with certain condition?

sshelly_splunk — Tue, 14 Jun 2022 19:40:25 GMT

When you use "transaction", there is a field created called "eventcount" which shows how many events are in each transaction. You can look for max eventcount, stats count by, etc ....

Re: How to write search to find number of Splunk transaction that start and end with certain condition?

btcs2 — Wed, 15 Jun 2022 06:39:37 GMT

No transaction startwith is not working with multiple OR .. one start with and multiple end with is working . so do we have a solution for this ?

Re: How to write search to find number of Splunk transaction that start and end with certain condition?

sshelly_splunk — Wed, 15 Jun 2022 16:29:46 GMT

I grabbed the Splunk tutorial data (from googling "splunk search tutorial") for this example.

source="tutorialdata.zip:*"
| transaction clientip JSESSIONID startswith=(action=addtocart) endswith=(action=purchase)

Note - the syntax for the startswith and endswith keyword specifications/filters. A transaction is created for each unique pair of clientip and JSESSIONID with succesful add's to cart and purchase.

Hope this helps.

Re: How to write search to find number of Splunk transaction that start and end with certain condition?

btcs2 — Wed, 15 Jun 2022 18:55:17 GMT

yes this will work . my question is that how to add multiple start with and multiple end with .. or alternative for the transaction .

index="prod" source="mysource" | transaction startswith="create happening for test" endswith=("create done for test " OR "create not done for test" )|stats count

Re: How to write search to find number of Splunk transaction that start and end with certain condition?

fredclown — Wed, 15 Jun 2022 22:00:30 GMT

Is something like this what you are looking for? All the stuff before the transaction command is just to create some test events.

| makeresults count=12 | streamstats count | eval _time=_time + count | eval value = case(count=1, "A", count=2, "C", count=3, "A", count=4, "D", count=5, "B", count=6, "C", count=7, "B", count=8, "D", count=9, "A", count=10, "F", count="11", "A", count="12", "G") | eval ip = "192.168.0.1" | transaction ip startswith=eval(value="A" OR value="B") endswith=eval(value="C" OR value="D")

Re: How to write search to find number of Splunk transaction that start and end with certain condition?

sshelly_splunk — Wed, 15 Jun 2022 22:12:38 GMT

I'll do my best to make pseudo SPL here:)

index="prod" source="mysource"

| transaction startswith=(fieldname=start_field_value OR filename=alternate_start_field_value) endswith=(diff_fieldname=end_value OR diff_fieldname2=alternate_fieldvalue)

|stats count

You will need to encapsulate your search in "()". If you could share field names, values desired, that would help.

I used an old eventgen data set and came up with the following. You can use this with your index(es), sourcetypes, etc.

index=main
| transaction clientip JSESSIONID startswith=(status=200 action=addtocart) endswith=(status=200 AND action=purchase)
| stats count by host

You can insert SPL into the "()" to define start and end. I would avoid using clear text search for any of the start/end filters though.