transaction endswith usage

sethuk555 — Wed, 19 Mar 2014 21:57:54 GMT

Hi,

We are trying to calculate the total system down time in minutes in a tabular format using the below query

But, somehow we are unable to combine these two types of system down logs "System Down" & "System Down - Unable to connect to the Database!" in our total calculation of outage. It somehow just takes the "System Down" into consideration. Below is the data set.
we are unable to use OR clause in the endswith utility under transaction.

2014-03-17 15:42:01-System Up
2014-03-17 15:37:01-System Up
2014-03-17 15:32:41-System Down
2014-03-17 15:25:01-System Down - Unable to connect to the Database!
2014-03-17 15:15:01-System Down - Unable to connect to the Database!
2014-03-17 15:05:02-System Down - Unable to connect to the Database!
2014-03-17 14:52:01-System Up
2014-03-17 14:47:01-System Up
2014-03-17 14:42:01-System Up

Re: transaction endswith usage

lguinn2 — Wed, 19 Mar 2014 23:24:36 GMT

I see several problems:

First, ( is not a valid character in a field name - unless you use quotation marks and then things get quite complicated.

Second, Splunk orders events, and transaction makes some assumptions about that order. Your dedup command was changing the default order. I wouldn't do that.

Third, I simplified and combined a few steps.

Try this:

sourcetype="nodecheck" 
| rex "System (?<upordown>(?:Up|Down))" 
| dedup upordown consecutive=true
| transaction startswith="System Down" endswith="System Up" 
| eval Outage_Minutes=ceiling(duration/60) 
| eval DownTimeStart = strftime(_time,"%x %X")
| table DownTimeStart Outage_Minutes 
| addcoltotals labelfield=Outage_Minutes label="Total"

topic transaction endswith usage in Splunk Search

transaction endswith usage

Re: transaction endswith usage