topic Re: Is it possible to only return events that have no corresponding start or end transaction event? in Splunk Search

Is it possible to only return events that have no corresponding start or end transaction event?

horsefez — Mon, 11 Jan 2016 12:14:09 GMT

Hi Splunk community,

I'm currently trying to correlate different event sources and events with each other.

My search gives me the following results:

Event A
Event B
Event A
Event B
Event B <---
Event A
Event B
Event A
Event B
etc.

You can see that there is one Event B that has no Event A in front of it.

Can I somehow tell Splunk to only show events where the Event is only B and no A before or only A and no B afterwards?

I know about transaction, but I don't know how to only show results that do not match a transaction condition.

Any suggestions to solve this without transactions?

Thank you in advance!

Regards,
pyro_wood

Re: Is it possible to only return events that have no corresponding start or end transaction event?

sundareshr — Mon, 11 Jan 2016 14:26:41 GMT

Assuming you have used transaction command and grouping appears right, you can use the keepevicted & closed_txn options to show events that are not grouped. So your command will look something like this

.... | transaction <unique_field> startswith=abc endswith=xyz keepevicted=t | table _raw closed_txn | where closed_txn=1

Re: Is it possible to only return events that have no corresponding start or end transaction event?

HeinzWaescher — Mon, 11 Jan 2016 16:11:11 GMT

Without transaction it could look like this by using the streamstats command:

| streamstats last(event) AS previous_event current=f window=1
| search event="B" AND previous_event!="A"

Re: Is it possible to only return events that have no corresponding start or end transaction event?

somesoni2 — Tue, 29 Sep 2020 08:24:18 GMT

You can include filter for event=A as well here. Like
....
| search (event="B" AND previous_event!="A") OR (event="A" AND previous_event!="B")

Re: Is it possible to only return events that have no corresponding start or end transaction event?

horsefez — Mon, 11 Jan 2016 16:23:53 GMT

Wow! :)))))))

Keepevicted is such a useful parameter. I almost gave up, not finding any solution.
Thank you, you literally made my day! 🙂

Re: Is it possible to only return events that have no corresponding start or end transaction event?

horsefez — Mon, 11 Jan 2016 16:53:36 GMT

Thank you for your suggestions!
I'll try them aswell!

Re: Is it possible to only return events that have no corresponding start or end transaction event?

gmartinn — Fri, 20 Mar 2020 11:56:19 GMT

keepevicted=true