Conditional Transaction

[zeophlite]

Hi

I'm looking to extract a specific subset of events in my Splunk data.

_time=3:01 type=update user=user2
_time=3:01 type=errorMessage cause=user1 data=bar1
_time=3:02 type=errorMessage cause=user1 data=wizz
_time=3:04 type=update user=user7
_time=3:07 type=errorMessage cause=user1 data=pow
_time=3:10 type=update user=user1
_time=3:11 type=update user=user4

I want to match cause in type=errorMessage to user in type=update , so the output for the above is:

_time=3:01 duration=9 eventcount=4 type=errorMessage cause=user1 data={bar1,wizz,pow} type=update user=user1

Any ideas how to have this behavior?

[somesoni2]

Try something like this

your base search | eval commonfield=if(type="update",user,cause) | transaction commonfield 

[kristian_kolb]

That would not differ in effect from coalesce() in case there are non-null user/cause fields in the 'wrong' events.

[kristian_kolb · Accepted solution]

You could try the coalesce() function to eval:

your_search | eval my_t_id = coalesce(user, cause) | transaction my_t_id

However, I think that if this is really your data, you'd need to set up some more constraints (time, number of events, start, stop etc) on the transaction. Otherwise it may be so that your transactions will span too many events.

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/CommonEvalFunctions
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

/K

[zeophlite]

Interesting - but what if the type=errorMessage events have a non-null user, and type=update have non-null cause fields?

[kristian_kolb]

Then the coalesce function will not be what you want. But since the sample data you posted did not have that limitation ...

There are other ways of accomplishing the desired results, e.g. sub-searches, joins etc. If you post some 'real' events, you will probably get better help.

/K