topic Re: chaining events together in Splunk Search

chaining events together

gregbujak — Mon, 28 Sep 2020 15:45:28 GMT

I am trying to figure out the query that would allow me to chain a series of events together. The issue here is that its an order system where the modification generates a new_id and puts the original id in old_id. old_id will be populated only the first modification message.

This can go on multiple times.

T1 new_id=1, old_id=, ...
T2 new_id=1, old_id=, ...
T3 new_id=2, old_id=1, ...
T4 new_id=2, old_id, ...
T5 new_id=3, old_id=2, ...
T6 new_id=3, old_id=,...
T7 new_id=3, old_id=,...

Modifications happen at T3,T5. Since all these events are technically part of a single conversation, is there a straight forward way to join a possible ENDLESS chain of these together? Any help would help.

I dont believe transaction addresses this particular case.

Re: chaining events together

_d_ — Wed, 29 Jan 2014 22:13:58 GMT

If old_id exists on the start event, this should do it:

| transaction new_id startswith=(old_id=*)

EDIT: the above, single transaction will isolate only changes. To "chain" those changes together try something like this:

..| eval my_id=if(isnotnull(old_id), "bar" , '') | transaction new_id startswith=(old_id=*) | transaction my_id

Re: chaining events together

martin_mueller — Wed, 29 Jan 2014 23:28:14 GMT

Wouldn't this open a new transaction every time the new_id is changed?

Re: chaining events together

_d_ — Mon, 28 Sep 2020 15:45:47 GMT

That's what the problem statement is, correct? "where the modification generates a new_id and puts the original id in old_id"

Re: chaining events together

martin_mueller — Wed, 29 Jan 2014 23:35:46 GMT

The way I understand it, the example in the question is one conversation/transaction. When a new new_id is generated, it's supposed to be chained to the old new_id through the now filled old_id field.

Re: chaining events together

gregbujak — Thu, 30 Jan 2014 15:15:02 GMT

All the events in this example are from a single conversation/transaction.

I dont think this accounts for the iterative nature of this type of conversation and the initial messages with null old_id

Re: chaining events together

_d_ — Thu, 30 Jan 2014 15:30:21 GMT

Ah okay...try the edit above.

Re: chaining events together

3no — Tue, 29 Sep 2020 13:26:00 GMT

Hey !

I don't know exactly what you are expecting as output...but I think this should do the job :

3no.