Splunk Search

Filtering Hosts within a Transaction

tbrown
Path Finder

So I have a search that is structured as follows 

index=main <filtering for start and end events> OR <filtering for events within start and end events>  | rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..." | transaction startswith="..." endswith="..."

The rex fields work, the transaction works, etc. However, In the events within the transaction, it pulls from every host that fits the filtering. Basically, I want to limit the transaction to only include the hosts that are listed in the Falling_Node and Rising_Node fields. I've tried adding "host=Falling_Node OR host=Rising_Node" in the "filtering for events within start and end events" but it either clears all events out of the transaction or does nothing.

Does anyone have tips?

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can tell the transaction command to use fields when matching up events.  Something like this

index=main <filtering for start and end events> OR <filtering for events within start and end events>  
| rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..." 
| transaction Rising_Node, Falling_Node startswith="..." endswith="..."
---
If this reply helps you, Karma would be appreciated.
0 Karma

tbrown
Path Finder

@richgalloway 

That would be a good solution, however only one  event (the last event) in my transactions actually contain the fields "Rising_Node" and "Falling_Node". That means that I can't sort the transaction like you mentioned because it would never find the "startswith" event to make the transactions. Do you have any alternative solutions?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this?

index=main <filtering for start and end events> OR <filtering for events within start and end events>  
| rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..." 
| where (host=Rising_Node OR host=Falling_Node)
| transaction startswith="..." endswith="..."
---
If this reply helps you, Karma would be appreciated.
0 Karma

tbrown
Path Finder

@richgalloway Unfortunately that didn't work either and it returns no results.   

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...