In every log statement, we write the user's session ID delimited by hyphens as follows:
I want to get a count of session IDs that contain two specific message strings (in separate log statements) in a specific order. I don't care if there are intervening log statements.
2017-08-11 12:51:57,918 INFO - whatever-S:ybiBmNiQxF-whatever STATEMENT1 whatever 2017-08-11 12:51:57,921 INFO - whatever-S:ybiBmNiQxF-whatever STATEMENT2 whatever
Is there a way to do this in a Splunk query?
Thanks for pointing me in the right direction. SInce there did not turn out to be any intervening events, I was able to use maxevents=2 with the TRANSACTION command:
index=my_index | rex field=_raw "-S:(?<SESSION_ID>\w+)-" | transaction SESSION_ID startswith="STATEMENT1" endswith="STATEMENT2" maxevents=2
Give this a try (assuming no field extraction was done, if it has, remove the rex commands)
your base search for selecting only STATEMENT1 and STATEMENT2 type of events | rex "S:(?<sessionID>[^\-]+)\S+\s+(?<Statement>\S+)" | stats list(Statement) as Statements by sessionID | where mvindex(Statements,0)="STATEMENT1" AND mvindex(Statements,1)="STATEMENT2" | stats count
Is the sessionID already extracted into a field? If so, then you can use the
transaction command to combine the sets of transactions (same sessionID) together and perform functions on those, whether it be counts, check for completed transactions, etc.
If it is not already extracted, then you will have to do a field extraction (either automatic or inline) to use the
transaction command. For that you may have to provide more complete example data in order to allow us to help with the field extraction.