I have log events that track incidents. Each log event has a ticket ID My work flow consists of 8 steps A,B,C,D,E,F,G,H. A is START, G is SUCCESS| FAIL and H is END, E is NEEDSATTENTION.
I am using the Splunk transaction command. However if I want to track Start to NEEEDSATTENTION then I get all transactions that have NEEDSATTENTION but I also get some that have gone pass this process to either SUCCESS FAIL or END. How can I only get transactions that have reached the NEEDSATTENTION process?
IS this something that needs to be a "multisearch"?
For Example index=incidents | transaction ticketid startswith=eval(workstatus="START")) endswith=eval(workstatus="NEEDSATTENTION")) | table ticketID userFirstName userLastName businessUnit duration
Transaction is the wrong tool for this. It's useful for some use cases, but this one isn't it.
index=incidents | fields ticketID userFirstName userLastName businessUnit workstatus | eventstats range(_time) as duration latest(workstatus) as currentstatus by ticketID | where currentstatus="NEEDSATTENTION"
This gives you every record for any ticketID whose current status is "NEEDSATTENTION". Each record contains the total
duration, defined as the number of seconds (epoch time) between the earliest
_time and the latest
_time. At this point, you probably want to just roll them together with a
| stats values(*) as * by ticketID
The last may need some finessing if some of the records contain different data from others. For instance, if you only wanted the latest userFirstName and userLastName, and so on.
Do you always have a very specific number of steps for the type of grouping you're looking for? If you do you can use eventcount to filter out the ones that go past your NEEDSATTENTION. It tells you how many events were grouped into your transaction so you could do a