SPL query to group deployment config downloads

[StephenD1]

Currently I'm running the following SPL to confirm the UF downloaded a new config:

index=_internal sourcetype=splunkd (component IN (DeployedApplication, PackageDownloadRestHandler) OR (component=loader "Splunkd starting") OR "Restarting Splunkd")
| transaction host

This results in something like the following for each host. It's almost what I want but the Deployment Server events are grouped into their own transaction.

I would like the group all of the above together into one transaction to show the download started/completed event from DS in the same group for that UF.

I tried including the startswith/endswith with various combinations of the following including with and without a field in the transaction command

index=_internal sourcetype=splunkd (component IN (DeployedApplication, PackageDownloadRestHandler) OR (component=loader "Splunkd starting") OR "Restarting Splunkd") 
| transaction startswith="checksum mismatch" endswith="splunkd starting"

but this keeps grouping events from different UFs together.

Any suggestions would be appreciated.

[livehybrid · Accepted solution]

Hi @StephenD1 

Does something like this help?

index=_internal sourcetype=splunkd (component=DeployedApplication AND ("Checksum mismatch" OR "Installing")) OR (component=loader "Splunkd starting") OR "Restarting Splunkd" 
| rex field=app "(?<app>[^\.]+)\.?" 
| eval splunkStarting=IF(LIKE(_raw,"%Splunkd starting%"),1,0) 
| eval checksumMismatch=IF(LIKE(_raw,"%checksum mismatch%"),1,0) 
| stats values(app) as app, max(splunkStarting) as SplunkRestarted, count(checksumMismatch) as checksumMismatches by host

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing