Advanced search question, match logs entries against other entries by string, show diff?

[darrel343]

My log entries look like this:

DATE: order=8 status=processed
-many entries in between-
DATE: order=8 status=completed

Is there some way I can get a count of instances where "order=X processed" is found but where "order=X completed" is not found? I'm pretty new to splunk queries, and have been reading up, but this is kind of specific and I'm not even sure if it's possible, so I thought I would ask.

Also, I can control the log files, so if there is a different way of separating fields or a way of logging that would make this easier, please let me know.

[chimell]

Hi darrel343
Try this search code i think it will help

  .......... status="processed" AND status!="completed"  |stats count by order |table count

[wpreston]

Like @bmcias84 said, transaction is the way to go. You'll want to include the keepevicted flag with it. Transaction will automatically add a field called closed_txn that tells you whether the transaction is complete or incomplete. Use this field in conjunction with stats to get the information you need. something like this:

your main search | transaction order startswith="status=processed" endswith="status=completed" keepevicted=t | stats count(eval(closed_txn="0")) as "Complete_Order_Transaction" count(eval(closed_txn="1" AND status="processed")) as "Order_Processed_But_No_Completion" count(eval(closed_txn="1" AND status="completed")) as "Order_Completed_But_Not_Processed"

[darrel343]

This answer was the most helpful in showing me how to make the transaction feature work, thanks.

[lguinn2]

This should work

yoursearchhere status=processed status=completed
| stats count(eval(status="processed")) as processed count(eval(status="completed")) as completed by order
| where processed >= 1 and completed < 1

Or you could use transaction as suggested, but it will be less efficient

yoursearchhere status=processed status=completed
| transaction order
| where eventcount < 2

[aweitzman]

One of the more efficient ways to do this is to gather your statuses for each order into a multivalued field and then filter your results by its contents:

...your search... 
| stats values(status) as statusvalues by order
| where statusvalues="processed" AND statusvalues!="completed" 
| table order

Splunk is nice that you can check any value of of a multivalued field using the = operator.

[bmacias84]

You do transaction on order id. then find where order don't contain completed. probably the simplest.