topic Re: how to find event that is outside a transaction in Splunk Search

how to find event that is outside a transaction

jgcsco — Mon, 04 May 2015 15:35:52 GMT

The transaction command has been helping me to correlate two events. Is there a way for me to find out the event that is not falling into the transaction?

event1, hostid
event2, hostid

|transaction hostid startswith=event1, endswith=event2

This will give me all the hostid that falls into both event1 and event2. How do I find out the hostid which is ONLY in event1 or event2?

Thanks,

Re: how to find event that is outside a transaction

aholzer — Mon, 04 May 2015 19:17:02 GMT

I believe the "keeporphans" flag is what you are looking for:

keeporphans=&lt;bool&gt;
Description: Specify whether the transaction command should output the results that are not part of any transactions. The results that are passed through as "orphans" are distinguished from transaction events with a _txn_orphan field, which has a value of 1 for orphan results. Defaults to false.

Got this from the Splunk docs on transactions.

Hope this helps.

Re: how to find event that is outside a transaction

jgcsco — Mon, 04 May 2015 21:07:14 GMT

the keepophans will include hostid that is in both event1 and event2, as well either event1 or event2. However, I am interested in ONLY in event1 or event2.

Re: how to find event that is outside a transaction

aholzer — Tue, 05 May 2015 00:51:32 GMT

@jgsco

Use | search _txn_orphan=1 after the transaction. That should return only the "orphans".

Re: how to find event that is outside a transaction

jgcsco — Tue, 05 May 2015 01:26:45 GMT

Thanks! That worked.