How to change the order the transaction command process the opened txn?

sttang88 — Tue, 29 Sep 2020 08:13:53 GMT

Hi everyone!

I'm trying to use a transaction to group logs that match the following business-logic:

all triggered actions are queued and processed following the FIFO policy
sometimes, many actions can be triggered before the first one is even completed
my logs does not include a common transaction_id that could be use to match the triggering and ACK events
thereby, I must assume that my first ACK is for the first triggered action, and so on.

My transaction command would looks like:
| transaction unit, option startswith="trigger" endswith="ack"

But it seems that Splunk is associating the first ACK event that match my transaction conditions with the last transaction it has opened. I would expect it to work the opposite way, or at least, I wish I could ask it to do so.

Here is a short data sample:

2015-12-28 20:02:02 action=ack unit=foobar option=disabled id=13
2015-12-28 20:02:00 action=ack unit=foobar option=enabled id=7
2015-12-28 20:02:00 action=ack unit=foobar option=disabled id=3
2015-12-28 20:01:59 action=trigger unit=foobar option=disabled
2015-12-28 20:01:59 action=ack unit=foobar option=enabled id=1
2015-12-28 20:01:18 action=trigger unit=foobar option=enabled
2015-12-28 20:00:57 action=trigger unit=foobar option=disabled
2015-12-28 20:00:17 action=trigger unit=foobar option=enabled

The command mentioned above is returning something like:

2015-12-28 20:01:59 action=trigger unit=foobar option=disabled
2015-12-28 20:02:00 action=ack unit=foobar option=disabled id=3
---
2015-12-28 20:01:18 action=trigger unit=foobar option=enabled
2015-12-28 20:01:59 action=ack unit=foobar option=enabled id=1
---
2015-12-28 20:00:57 action=trigger unit=foobar option=disabled
2015-12-28 20:02:02 action=ack unit=foobar option=disabled id=13
---
2015-12-28 20:00:17 action=trigger unit=foobar option=enabled
2015-12-28 20:02:00 action=ack unit=foobar option=enabled id=7

When I would expect:

2015-12-28 20:01:59 action=trigger unit=foobar option=disabled
2015-12-28 20:02:02 action=ack unit=foobar option=disabled id=13
---
2015-12-28 20:01:18 action=trigger unit=foobar option=enabled
2015-12-28 20:02:00 action=ack unit=foobar option=enabled id=7
---
2015-12-28 20:00:57 action=trigger unit=foobar option=disabled
2015-12-28 20:02:00 action=ack unit=foobar option=disabled id=3
---
2015-12-28 20:00:17 action=trigger unit=foobar option=enabled
2015-12-28 20:01:59 action=ack unit=foobar option=enabled id=1

Hope I was clear enough and thank you for your help 🙂

Re: How to change the order the transaction command process the opened txn?

sundareshr — Wed, 30 Dec 2015 17:36:03 GMT

How about something like this... you should be able to build on it

... | streamstats count as c by action | sort c

Re: How to change the order the transaction command process the opened txn?

sttang88 — Wed, 30 Dec 2015 23:00:19 GMT

Thanks @sundareshr!

I finally had to add all the fields used in my transaction to the streamstats count to make it work.

For futur record, here is my final query:
| streamstats count AS c by unit, option, action | sort c | transaction unit, option, c startswith="trigger" endswith="ack"

Thank you 🙂

topic Re: How to change the order the transaction command process the opened txn? in Splunk Search

How to change the order the transaction command process the opened txn?

Re: How to change the order the transaction command process the opened txn?

Re: How to change the order the transaction command process the opened txn?