topic Re: Filter transaction in Splunk Search

Filter transaction

indeed_2000 — Fri, 03 Nov 2023 10:24:55 GMT

i have log line like this,

1-need to group by them by ID,

2- filter those transactions that has T[A]

#txn1
16:30:53:002 moduleA ID[123]
16:30:54:002 moduleA ID[123]
16:30:55:002 moduleB ID[123]T[A]
16:30:56:002 moduleC ID[123]

#txn2
16:30:57:002 moduleD ID[987]
16:30:58:002 moduleE ID[987]T[B]
16:30:59:002 moduleF ID[987]
16:30:60:002 moduleZ ID[987]

Any idea?

Thanks

Re: Filter transaction

ITWhisperer — Fri, 03 Nov 2023 10:57:50 GMT

What fields do you already have extracted?

By "filter" do you mean filter in or filter out i.e. do you want to keep the events with T[A], keep only those events with T[A] or remove them altogether?

Re: Filter transaction

indeed_2000 — Fri, 03 Nov 2023 17:15:41 GMT

@ITWhisperer need to see filter out/in result to decide.

All fields extracted already.

need keep the events with T[A].

Re: Filter transaction

ITWhisperer — Fri, 03 Nov 2023 19:02:05 GMT

| sort 0 ID

Re: Filter transaction

indeed_2000 — Fri, 03 Nov 2023 19:13:46 GMT

@ITWhisperer ?

Re: Filter transaction

ITWhisperer — Fri, 03 Nov 2023 19:25:33 GMT

Your events will be together by ID

Re: Filter transaction

indeed_2000 — Fri, 03 Nov 2023 20:01:05 GMT

@ITWhisperer

How about other part?

FYI: i mean extract key value one by one with rex command not whole transaction.

Re: Filter transaction

ITWhisperer — Fri, 03 Nov 2023 20:52:45 GMT

Not sure I understand, you just said all fields already extracted?

Re: Filter transaction

indeed_2000 — Fri, 03 Nov 2023 21:04:08 GMT

@ITWhisperer i mean id, t , … key value extracted not transaction.

Re: Filter transaction

ITWhisperer — Sat, 04 Nov 2023 10:19:14 GMT

What do you mean by transaction?

Re: Filter transaction

indeed_2000 — Sat, 04 Nov 2023 14:49:16 GMT

@ITWhisperer

#txn1
16:30:53:002 moduleA ID[123]
16:30:54:002 moduleA ID[123]
16:30:55:002 moduleB ID[123]T[A]
16:30:56:002 moduleC ID[123]

#txn2
16:30:57:002 moduleD ID[987]
16:30:58:002 moduleE ID[987]T[B]
16:30:59:002 moduleF ID[987]
16:30:60:002 moduleZ ID[987]

Re: Filter transaction

ITWhisperer — Sat, 04 Nov 2023 16:23:56 GMT

How do you determine which events are part of a "transaction"?

Re: Filter transaction

indeed_2000 — Sat, 04 Nov 2023 16:25:34 GMT

@ITWhisperer group by id

Re: Filter transaction

ITWhisperer — Sat, 04 Nov 2023 16:31:40 GMT

| stats list(_raw) as _raw by ID

Re: Filter transaction

indeed_2000 — Sat, 04 Nov 2023 18:20:31 GMT

@ITWhisperer you miss main question and I tell you step by step main question!

Would you please check main question? And tell me is there any way to do that?

thanks

Re: Filter transaction

ITWhisperer — Sat, 04 Nov 2023 20:09:21 GMT

| stats list(_raw) as _raw list(T) as T by ID | where T=="A"