topic Re: Finding events immediately following/preceding another event in Splunk Search

How to find events immediately following/preceding another event?

AjayTakur — Fri, 21 Apr 2023 18:13:35 GMT

I have to search for events

I have one event let's say MIT=" step started"
and another event says MIT=" step completed"

Now I have to ensure that both events have been included in my search criteria
in such a way that

Case 1:The first event is started the second event will get completed.

Case 2: If the first event is not started then the second event will also not be complete.
Considering these conditions I need search criteria.

Re: Finding events immediately following/preceding another event

inventsekar — Wed, 19 Apr 2023 19:26:38 GMT

Hi @AjayTakur

the question is bit confusion, but, nevertheless, basically you need Splunk's transaction command:

https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Transaction#Basic_Examples

Very basic rough draft SPL:

index=a source=b sourcetype=c | transaction MIT startswith=" step started" endswith=" step completed" maxspan=2s

Re: Finding events immediately following/preceding another event

AjayTakur — Thu, 20 Apr 2023 17:20:13 GMT

for two different events ie., started and successful the successful might not be an event happening after started then, in this case, is this search criteria correct?

index=a source=b | transaction startswith=MIT="Local Step started." endswith=MIT="Copy step successful." keepevicted=true | search closed_txn=0

Re: Finding events immediately following/preceding another event

woodcock — Thu, 20 Apr 2023 23:29:41 GMT

Never use the "transaction" command for production. Try this:

index="YourIndexHere" AND sourcetype="YourSourcetypeHere" AND MIT IN("step started", step completed")
| stremstats count(eval(MIT="stepstarted")) AS SessionID BY host ```And maybe other fields here```
| stats min(_time) AS _time range(_time) AS duration dc(MIT) AS MITcount values(MIT) AS MIT BY host ``And maybe other fields here```