Splunk Search

Filtering Hosts within a Transaction

tbrown
Path Finder

So I have a search that is structured as follows 

index=main <filtering for start and end events> OR <filtering for events within start and end events>  | rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..." | transaction startswith="..." endswith="..."

The rex fields work, the transaction works, etc. However, In the events within the transaction, it pulls from every host that fits the filtering. Basically, I want to limit the transaction to only include the hosts that are listed in the Falling_Node and Rising_Node fields. I've tried adding "host=Falling_Node OR host=Rising_Node" in the "filtering for events within start and end events" but it either clears all events out of the transaction or does nothing.

Does anyone have tips?

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can tell the transaction command to use fields when matching up events.  Something like this

index=main <filtering for start and end events> OR <filtering for events within start and end events>  
| rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..." 
| transaction Rising_Node, Falling_Node startswith="..." endswith="..."
---
If this reply helps you, Karma would be appreciated.
0 Karma

tbrown
Path Finder

@richgalloway 

That would be a good solution, however only one  event (the last event) in my transactions actually contain the fields "Rising_Node" and "Falling_Node". That means that I can't sort the transaction like you mentioned because it would never find the "startswith" event to make the transactions. Do you have any alternative solutions?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this?

index=main <filtering for start and end events> OR <filtering for events within start and end events>  
| rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..." 
| where (host=Rising_Node OR host=Falling_Node)
| transaction startswith="..." endswith="..."
---
If this reply helps you, Karma would be appreciated.
0 Karma

tbrown
Path Finder

@richgalloway Unfortunately that didn't work either and it returns no results.   

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...