topic Re: Conditional Transaction in Splunk Search

Conditional Transaction

zeophlite — Wed, 23 Mar 2016 09:52:21 GMT

I'm looking to extract a specific subset of events in my Splunk data.

_time=3:01 type=update user=user2
_time=3:01 type=errorMessage cause=user1 data=bar1
_time=3:02 type=errorMessage cause=user1 data=wizz
_time=3:04 type=update user=user7
_time=3:07 type=errorMessage cause=user1 data=pow
_time=3:10 type=update user=user1
_time=3:11 type=update user=user4

I want to match cause in type=errorMessage to user in type=update , so the output for the above is:

_time=3:01 duration=9 eventcount=4 type=errorMessage cause=user1 data={bar1,wizz,pow} type=update user=user1

Any ideas how to have this behavior?

Re: Conditional Transaction

kristian_kolb — Wed, 23 Mar 2016 10:16:13 GMT

You could try the coalesce() function to eval:

your_search | eval my_t_id = coalesce(user, cause) | transaction my_t_id

However, I think that if this is really your data, you'd need to set up some more constraints (time, number of events, start, stop etc) on the transaction. Otherwise it may be so that your transactions will span too many events.

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/CommonEvalFunctions
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

Re: Conditional Transaction

zeophlite — Wed, 23 Mar 2016 11:27:03 GMT

Interesting - but what if the type=errorMessage events have a non-null user, and type=update have non-null cause fields?

Re: Conditional Transaction

kristian_kolb — Wed, 23 Mar 2016 11:35:44 GMT

Then the coalesce function will not be what you want. But since the sample data you posted did not have that limitation ...

There are other ways of accomplishing the desired results, e.g. sub-searches, joins etc. If you post some 'real' events, you will probably get better help.

Re: Conditional Transaction

somesoni2 — Wed, 23 Mar 2016 14:12:01 GMT

Try something like this

your base search | eval commonfield=if(type="update",user,cause) | transaction commonfield

Re: Conditional Transaction

kristian_kolb — Wed, 23 Mar 2016 21:08:37 GMT

That would not differ in effect from coalesce() in case there are non-null user/cause fields in the 'wrong' events.