Splunk Search

Exclude an Event Based on Value From Another Event

jepoyyyy
Explorer

Hi All,

I have a set of log that contains events something similar to this:

Event A
[09-23-16 16:03:35:972] TransactionID(0900001) Request SomeText SomeTxt amount=90

Event B
[09-23-16 16:03:35:973] TransactionID(0900001) Received packet 'HTTP/1.1 200 OK

There are other events for each transaction but I am only interested in these two lines. I need to get the sum of the amount but only for transactions that are successful which is indicated in the next event with status "200 OK"

I'm thinking of using transaction command but it would be too expensive. Are there any approach other that grouping it using transaction command?

Thanks in advance!
-Jeff

0 Karma
1 Solution

alemarzu
Motivator

Hi there jepoyyy,

Assuming that you don't have certain fields already extracted, try this.

main search  | rex "TransactionID\((?<transactionId>\d+)\)\s" | rex "\)\sReceived\spacket\s\S+\s(?<status>\d+)\s\w+$" | stats latest(_time) AS lastTime, sum(amount) AS Amount, values(status) AS Status by transactionId | where Status=200 | convert ctime(lastTime)

Hope it helps.

View solution in original post

alemarzu
Motivator

Hi there jepoyyy,

Assuming that you don't have certain fields already extracted, try this.

main search  | rex "TransactionID\((?<transactionId>\d+)\)\s" | rex "\)\sReceived\spacket\s\S+\s(?<status>\d+)\s\w+$" | stats latest(_time) AS lastTime, sum(amount) AS Amount, values(status) AS Status by transactionId | where Status=200 | convert ctime(lastTime)

Hope it helps.

jepoyyyy
Explorer

Thank you for pointing me to the right direction!

0 Karma

alemarzu
Motivator

I'm glad it helped you! Happy Splunking!

0 Karma

sundareshr
Legend

Try this. if a transaction id can have more than request and response

index=xyz "Request SomeText" OR "Received packet 'HTTP/1.1 200 OK" | rex "TransactionID\((?<id>\d+)\)\s(?<action>Received|Request)" | stats sum(Amount) as Total count(eval(action=Received)) as Recd count(eval(action=Request)) as Req by id | where Recd=Req 
0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...