Splunk Search

Finding Events Between Other Events

DLThurston
Observer

I might be confusing myself by making this harder than it is...

Say I have a log where the events are:

LOGIN
ACTION (1)
ACTION (2)
LOGOUT
LOGIN
ACTION (3)
ACTION (4)
ACTION (5)
LOGOUT

What I would like is to be able to display all the ACTION events that happened between just the first LOGIN/LOGOUT pair and output:

ACTION (1)
ACTION (2)

This is in a dashboard, and I've got dropdowns to identify each unique LOGIN event, those are working just fine. I tried a transaction, but I think that might be the wrong tool for the job, and I'm worried I got too fixated on that and am now missing the forest for the trees. What I want is all ACTION events bounded by the selected LOGIN and the next subsequent LOGOUT. So in terms of metacode I want something along the lines of...

| search ACTION earliest=LOGIN._time latest=LOGOUT._time

Does that make sense? Am I approaching this from the wrong direction? Or is this just a bit of search code I haven't figured out?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is there any attribute in the events which ties the action events to the login session they are part of?

0 Karma

DLThurston
Observer

Unfortunately no. What I'm basically attempting to do is create sessions where none exist within a text-based log that shows login/logout events, but where the actions in between are not tied to a session or to a user account. Fun, right?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval _raw="LOGIN
ACTION (1)
ACTION (2)
LOGOUT
LOGIN
ACTION (3)
ACTION (4)
ACTION (5)
LOGOUT"
| multikv noheader=t
| fields _raw
| fields - _time
| streamstats count(eval(_raw="LOGIN")) as session
| where _raw != "LOGIN" AND _raw != "LOGOUT"
| stats values(_raw) as events by session
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...