Conditional field based on transaction

[kbaden]

Hi

I am currently using transaction to generate a report on length of user session, which is working well. The next iteration is to remove the time the computer is idle [ Windows goes to sleep after 30mins (1800 sec) at which point the event log is "The screen saver was invoked". So if that happens i need to remove 1800seconds from the timer.

Using the transaction i'm defining:
startswith=eval(match(_raw,"BROKER_LOGON"))
endswith=eval(match(_raw,"BROKER_LOGOFF") OR match(_raw,"The screen saver was invoked"))

I've currently created a field after the transaction "SessionLength", which is defined as duration/60 to show minute length.

I need to have something to the effect of:

IF Transaction closes with "The screen saver was invoked", SessionLength=((duration - 1800)/60)
ELSE SessionLength=(Duration/60)

This is to counter the lack of mouse movement over the last 1800seconds which leads to this event log. I've tried all sorts of IF, CASE... but don't know how reference the last event/message in a transaction. Even if I can say that IF contains "The screen..." then do this, else do that - would be sufficient.

Still relatively new to Splunk, tried exploring for days before posting. Any thoughts?

Example:
eval SessionLength(minutes)=if(transaction = "The screen saver was invoked", ((duration - 1800)/60),(duration/60))
so if the transaction is "The screen.." the field equals duration - 1800 then divided by 60. If it doesnt contain the statement its just duration divided by 60.

[sundareshr · Accepted solution]

You don't need the transaction command for this. Try using stats instead, like this...

base search | eval status=case(match(_raw, "BROKER_LOGON"), "LogOn", match(_raw, "BROKER_LOGOFF"), "LogOff", match(_raw, "screen saver was invoked"), "ScreenSaver", 1=1, "Unknown") | chart earliest(_time) over transaction_id by status | eval SessionLength=case(isnull(Screensaver), (LogOff-LogOn)/60, isnotnull(ScreenSaver), ((duration - 1800)/60), 1=1, 0) | eval SessionLength=tostring(SessionLength, "duration")

[kbaden]

Thanks a lot!