Splunk Search

Conditional Transaction

zeophlite
New Member

Hi

I'm looking to extract a specific subset of events in my Splunk data.

_time=3:01 type=update user=user2
_time=3:01 type=errorMessage cause=user1 data=bar1
_time=3:02 type=errorMessage cause=user1 data=wizz
_time=3:04 type=update user=user7
_time=3:07 type=errorMessage cause=user1 data=pow
_time=3:10 type=update user=user1
_time=3:11 type=update user=user4

I want to match cause in type=errorMessage to user in type=update , so the output for the above is:

_time=3:01 duration=9 eventcount=4 type=errorMessage cause=user1 data={bar1,wizz,pow} type=update user=user1

Any ideas how to have this behavior?

0 Karma
1 Solution

kristian_kolb
Ultra Champion

You could try the coalesce() function to eval:

your_search | eval my_t_id = coalesce(user, cause) | transaction my_t_id

However, I think that if this is really your data, you'd need to set up some more constraints (time, number of events, start, stop etc) on the transaction. Otherwise it may be so that your transactions will span too many events.

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/CommonEvalFunctions
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

/K

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your base search | eval commonfield=if(type="update",user,cause) | transaction commonfield 
0 Karma

kristian_kolb
Ultra Champion

That would not differ in effect from coalesce() in case there are non-null user/cause fields in the 'wrong' events.

0 Karma

kristian_kolb
Ultra Champion

You could try the coalesce() function to eval:

your_search | eval my_t_id = coalesce(user, cause) | transaction my_t_id

However, I think that if this is really your data, you'd need to set up some more constraints (time, number of events, start, stop etc) on the transaction. Otherwise it may be so that your transactions will span too many events.

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/CommonEvalFunctions
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

/K

0 Karma

zeophlite
New Member

Interesting - but what if the type=errorMessage events have a non-null user, and type=update have non-null cause fields?

0 Karma

kristian_kolb
Ultra Champion

Then the coalesce function will not be what you want. But since the sample data you posted did not have that limitation ...

There are other ways of accomplishing the desired results, e.g. sub-searches, joins etc. If you post some 'real' events, you will probably get better help.

/K

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...