topic Re: how to get incomplete transactions in Splunk Search

how to get incomplete transactions

Laya123 — Mon, 28 Sep 2020 19:40:20 GMT

Hi,

I need small help from you, I am calculating duration of each transaction of on userid.

My query:

the above query is giving correct results only, but there is some transactions which is not having 'Ending session', for some transaction there is no 'Beginning and ending session'. I know that where the beginning and end session are not there were incomplete transactions and their status is error. but I am not getting those DIDs in my output, I am getting only where Beginning and ending session DIDs.

Pl help me to do this

here is some sample logs which not having beginning and ending sessions

Logs:
1. No Ending session but having 3-4 log lines
117,20150418 05:09:42.860,155,32,MIV,1615241 - 0xc64,-P -R6801ddbc-1528-472f-805a-d9645c4ffa0c -I351 Beginning session
208,20150418 05:10:18.111,155,32,MIV,1615241 - 0xc64,-PC2BBD -R6801ddbc-1528-472f-805a-d9645c4ffa0c -I351 Processed package bc7f579a-6a59-495f-b23e-059ea49e963c from client 6801ddbc-1528-472f-805a-d9645c4ffa0c
208,20150418 05:12:21.193,155,32,MIV,1615241 - 0xc64,-PCX2J6 -R6801ddbc-1528-472f-805a-d9645c4ffa0c -I351 Processed package deca35af-62f4-4db4-8fa5-ff01784f085d from client 6801ddbc-1528-472f-805a-d9645c4ffa0c

No ending session with one log line
118,20150418 09:52:10.058,155,32,MIV,1634745 - 0x1aac,-P -Rbde65047-6274-4fbf-98bd-b8593b014dd9 -I152 Beginning session
For some dids there is no beginning session and endining session as per logs its starting with ‘session does not exist’

277,20150414 14:15:56.227,155,4,MIV,1333626 - 0x13a4,-P -R -I Session does not exist for 2dd0b5a3-bcbe-428f-b8b0-23aefc96e0a4
268,20150414 14:08:53.198,155,4,MIV,1333626 - 0x13a4,-P -R -I Session does not exist for 9edb5b57-85f1-47c6-a3e3-62ebf5767990

Thanks in advance

Re: how to get incomplete transactions

esix_splunk — Fri, 24 Apr 2015 04:54:25 GMT

I think you would like to keep include events that dont match the transaction command. You can add the 'keepevicted=true' flag to your transaction command in search. Then all of your events will have a 'closed_txn' field which is boolean 0 or 1 depending if the transaction is complete or not. From there you can look at non-closed transaction events and decide what to do..

http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Transaction

Re: how to get incomplete transactions

Laya123 — Fri, 24 Apr 2015 05:13:56 GMT

Hi,

Thanks for your immediate response,

I tried keepevicted and close_txn but i didnt get the results what i expected. May be I am using these 2 commands in wrong place, If you dont mind can you please tell me where I can use these 2 commands with a small example

thank you so much

Regards

Re: how to get incomplete transactions

esix_splunk — Fri, 24 Apr 2015 05:19:25 GMT

Refer to the docs for syntax : http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Transaction

... | transaction keepevicted=true ....

After that, you will have a new field called closed_txn. Filter your results based on the values of that field and see how your results look.

Re: how to get incomplete transactions

Laya123 — Fri, 24 Apr 2015 05:25:42 GMT

Thank you so much, I will try this and let you know

Re: how to get incomplete transactions

Laya123 — Fri, 24 Apr 2015 13:43:48 GMT

Hi,

I tried keepevicted =true but no luck. Pl suggest me is there any other way to do this

Thanks & Regards

Re: how to get incomplete transactions

fdi01 — Mon, 28 Sep 2020 19:40:28 GMT

for :
No Ending session but having 3-4 log lines try like this:

   ...|transaction DID maxevents=10000 startswith="Beginning session"  |...

For some dids there is no beginning session and endining session as per logs its starting with ‘session does not exist’
try like this:

 ...|transaction  "Session does not exist" maxevents=10000|...

you can use this transaction option keeporphans=true
because it Specify whether the transaction command should output the results that are not part of any transactions. The results that are passed through as "orphans" are distinguished from transaction events with a _txn_orphan field, which has a value of 1 for orphan results. Defaults to false.

Re: how to get incomplete transactions

Laya123 — Fri, 24 Apr 2015 14:59:54 GMT

Hi,

Thank you for your response,

It means you want me to use two transactions in one search

Regards

Re: how to get incomplete transactions

fdi01 — Sat, 25 Apr 2015 08:49:17 GMT

yes you can.

Re: how to get incomplete transactions

Laya123 — Mon, 27 Apr 2015 13:26:59 GMT

as per your suggestion i have taken two transactions but its giving error.