topic How to write a search to count variations (different order and number) of transaction events? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-count-variations-different-order-and/m-p/281265#M84842 <P>I need a search to count variations of event occurance. Lets say we have events:<BR /> A,B,C,D,E which are combined into transaction by sessionid.<BR /> Event A is a start<BR /> Event E is an end.</P> <P>In time, I have to search for transactions which have a different order and number of middle steps:<BR /> ABCDE<BR /> ACBDE <BR /> ABCDBCDE<BR /> and so on...</P> <P>I need a stats count how many all of variations have occurred... I cannot predict all of the possible variations as steps are repeating between start and stop.</P> <P>I need a table:<BR /> VARIANT - COUNT<BR /> ABCDE - 10<BR /> ABBE - 3<BR /> etc...</P> <P>Any useful searches/commands I can try?</P> Fri, 16 Oct 2015 09:09:52 GMT adamguzek 2015-10-16T09:09:52Z How to write a search to count variations (different order and number) of transaction events? https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-count-variations-different-order-and/m-p/281265#M84842 <P>I need a search to count variations of event occurance. Lets say we have events:<BR /> A,B,C,D,E which are combined into transaction by sessionid.<BR /> Event A is a start<BR /> Event E is an end.</P> <P>In time, I have to search for transactions which have a different order and number of middle steps:<BR /> ABCDE<BR /> ACBDE <BR /> ABCDBCDE<BR /> and so on...</P> <P>I need a stats count how many all of variations have occurred... I cannot predict all of the possible variations as steps are repeating between start and stop.</P> <P>I need a table:<BR /> VARIANT - COUNT<BR /> ABCDE - 10<BR /> ABBE - 3<BR /> etc...</P> <P>Any useful searches/commands I can try?</P> Fri, 16 Oct 2015 09:09:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-count-variations-different-order-and/m-p/281265#M84842 adamguzek 2015-10-16T09:09:52Z Re: How to write a search to count variations (different order and number) of transaction events? https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-count-variations-different-order-and/m-p/281266#M84843 <P>Yes, check out the <CODE>cluster</CODE> command:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/cluster">http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/cluster</A></P> Fri, 16 Oct 2015 14:32:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-count-variations-different-order-and/m-p/281266#M84843 woodcock 2015-10-16T14:32:51Z Re: How to write a search to count variations (different order and number) of transaction events? https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-count-variations-different-order-and/m-p/281267#M84844 <P>Try this!</P> <PRE><CODE>your search | transaction startswith=A endswith=E|eval VARIANT=mvjoin(event, "-")|stats count by VARIANT </CODE></PRE> Fri, 16 Oct 2015 17:16:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-count-variations-different-order-and/m-p/281267#M84844 HiroshiSatoh 2015-10-16T17:16:47Z