Splunk Search

Conditional Transaction

zeophlite
New Member

Hi

I'm looking to extract a specific subset of events in my Splunk data.

_time=3:01 type=update user=user2
_time=3:01 type=errorMessage cause=user1 data=bar1
_time=3:02 type=errorMessage cause=user1 data=wizz
_time=3:04 type=update user=user7
_time=3:07 type=errorMessage cause=user1 data=pow
_time=3:10 type=update user=user1
_time=3:11 type=update user=user4

I want to match cause in type=errorMessage to user in type=update , so the output for the above is:

_time=3:01 duration=9 eventcount=4 type=errorMessage cause=user1 data={bar1,wizz,pow} type=update user=user1

Any ideas how to have this behavior?

0 Karma
1 Solution

kristian_kolb
Ultra Champion

You could try the coalesce() function to eval:

your_search | eval my_t_id = coalesce(user, cause) | transaction my_t_id

However, I think that if this is really your data, you'd need to set up some more constraints (time, number of events, start, stop etc) on the transaction. Otherwise it may be so that your transactions will span too many events.

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/CommonEvalFunctions
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

/K

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

your base search | eval commonfield=if(type="update",user,cause) | transaction commonfield 
0 Karma

kristian_kolb
Ultra Champion

That would not differ in effect from coalesce() in case there are non-null user/cause fields in the 'wrong' events.

0 Karma

kristian_kolb
Ultra Champion

You could try the coalesce() function to eval:

your_search | eval my_t_id = coalesce(user, cause) | transaction my_t_id

However, I think that if this is really your data, you'd need to set up some more constraints (time, number of events, start, stop etc) on the transaction. Otherwise it may be so that your transactions will span too many events.

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/CommonEvalFunctions
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

/K

View solution in original post

0 Karma

zeophlite
New Member

Interesting - but what if the type=errorMessage events have a non-null user, and type=update have non-null cause fields?

0 Karma

kristian_kolb
Ultra Champion

Then the coalesce function will not be what you want. But since the sample data you posted did not have that limitation ...

There are other ways of accomplishing the desired results, e.g. sub-searches, joins etc. If you post some 'real' events, you will probably get better help.

/K

0 Karma