topic Re: Transaction with count of successive events in Splunk Search

Transaction with count of successive events

chrispappo — Tue, 10 Nov 2015 10:25:37 GMT

Hi,

If I have several events like this:

ID1 name1
ID2 name2
ID3 name1
ID3 name1
ID3 name1
ID4 name3
ID3 name1

I would like to have the number of successive events by ID and by Name. So it will give me something like this:

ID1 name1 1
ID2 name2 1
ID3 name1 3
ID4 name3 1
ID3 name1 1

My problem is with the transaction. It will regroup every identical ID instead of regrouping events that are successive, with the same ID and name.

Can someone help me?
Thanks

Re: Transaction with count of successive events

chrispappo — Tue, 10 Nov 2015 15:12:44 GMT

anyone can help 🙂 ?

Re: Transaction with count of successive events

Richfez — Tue, 10 Nov 2015 15:31:53 GMT

If those have field names of "ID" and "Name", then the simple way would be

... | stats count by ID, Name

Transaction could be useful in other circumstances (perhaps even on this same data), but isn't probably what you need here.

Re: Transaction with count of successive events

chrispappo — Tue, 10 Nov 2015 15:38:03 GMT

thanks for answering. The problem is with your order the result will be

ID1 name1 1 
ID2 name2 1
ID3 name1 4
ID4 name3 1

And I want something like

ID1 name1 1 
ID2 name2 1
ID3 name1 3
ID4 name3 1 
ID3 name1 1

as you can see it's different from what I want, i want to count ONLY the following events who own the same ID/NAME!

could you help ?

Re: Transaction with count of successive events

Richfez — Tue, 10 Nov 2015 16:12:43 GMT

So you need them bounded by intervening, non-matching events? What I mean by that is that you want to not have a transaction cross another item - so an ID4 splits that ID3/name1 into two chunks, the before one and after one. Right?

If so, I'd recommend using streamstats to split your events by counting number of distinct IDs in a two-item streamstats group. The short version:

... | streamstats window=2 distinct_count(ID) AS splitter| transaction startswith=splitter>1 ID name

The longer version: I answered another question a while back with a similar solution that has explanations, so please refer to this answer here for more information.

Let me know how it goes or if you need help with some tweaking!

Re: Transaction with count of successive events

sundareshr — Tue, 10 Nov 2015 16:32:43 GMT

I believe you are looking for the eventstats command http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/eventstats

In your example, something like this may work..`.. | sort idcolname | eventstats count by idcolname | dedup idcolname

If this doesn't give you what you are looking for, try the streamstats command` http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/streamstats