topic Re: "transaction" command: have four "startswith" and two "endswith" patterns for the same in Splunk Search

"transaction" command: have four "startswith" and two "endswith" patterns for the same transaction

sp — Wed, 08 Nov 2023 06:41:30 GMT

I need to run a Splunk search with "transaction" command and I have four pattern variations for the start of the transaction and two pattern variations for the end of that transaction.

I read the documentation and experimented but still not sure how exactly I should do this. I am operating on complex extensive data so it's not immediately clear whether I am doing this correctly and I need to get it right. I tried the following:

1. Wildcards in startswith and endswith: "endswith=...*..."

2. The syntax "endswith=... OR endswith=...". -- same for startswith

3. The syntax "endswith=... OR ...".

4. Regular expressions instead of wildcards: .* instead of *

Could you suggest the right way of doing this?

Thank you!

Re: "transaction" command: have four "startswith" and two "endswith" patterns for the same

bowesmana — Wed, 08 Nov 2023 07:03:39 GMT

I would suggest looking at ways of NOT using transaction, as it has limitations. stats can often solve the problem of transaction.

Perhaps you can give an example of your data and say what you are trying to achieve - then the right solution may be clearer.

You can use eval statements in starts and endswith, but before you go down that route, let's see what you're trying to get to

Re: "transaction" command: have four "startswith" and two "endswith" patterns for the same

gcusello — Wed, 08 Nov 2023 07:37:45 GMT

Hi @sp ,

as @bowesmana said, transaction command should be avoided all times that's possible.

probably the only condition when it could be used is when you have to use startswith or endswith conditions.

Anyway, you can use the OR condition:

| transaction startswith=("string1" OR "string2" OR "string3" OR "string4") endswith=("string5" OR "string6")

Ciao.

Giuseppe