Hey gang - searching for missing data is probably the weakest part of my Splunk skillset. I just have a hard time thinking through how to even write such a query.
I have a transaction that usually goes event_name=A, event_name=B, event_name=C. But I'm trying to research a situation where B is missing sometimes. I'd like to be able to build a timechart that shows the number of transactions in which B is missing. The events in transaction are all linked by a common identifier that we'll call session_id.
I've looked at the transaction command and I suppose I understand that.
index=indexname event_name=A OR event_name=B OR event_name=C | transaction session_id startsWith=A endsWith=C maxspan=10m
But I don't know where to go from here.
Assuming that session_id is unique across transactions, this will tell you when a transaction with fewer than 3 unique events started and finished
index=indexname event_name=A OR event_name=B OR event_name=C
| stats dc(event_name) as events earliest(_time) as start latest(_time) as end by session_id
| where events < 3
If you specifically want the check event B, you could
index=indexname event_name=A OR event_name=B OR event_name=C
| stats values(event_name) as events earliest(_time) as start latest(_time) as end by session_id
| where isnull(mvfind(events,"B"))
Your second query here is basically what I was looking for. To make it work as a timechart I ended up doing this:
index=indexname event_name=A OR event_name=B OR event_name=C
| stats values(event_name) as events earliest(_time) as start latest(_time) as end by session_id
| where isnull(mvfind(events,"B"))
| eval _time=start
| timechart count
THANK YOU!!!
Assuming that session_id is unique across transactions, this will tell you when a transaction with fewer than 3 unique events started and finished
index=indexname event_name=A OR event_name=B OR event_name=C
| stats dc(event_name) as events earliest(_time) as start latest(_time) as end by session_id
| where events < 3
If you specifically want the check event B, you could
index=indexname event_name=A OR event_name=B OR event_name=C
| stats values(event_name) as events earliest(_time) as start latest(_time) as end by session_id
| where isnull(mvfind(events,"B"))