Splunk Search

Help with subsearch

mburbidg
Explorer

I have two different kinds of events. I would like to relate the two. The first event looks like this.

[2012-02-02 20:17:51,931] INFO - sessionId=8AD487DD-DB3F-4C3E-AB9A-302ABF05E6FC code=NewsStandPushNotificationReceived externalSignInStatus=true

The second looks like this.

[2012-02-02 20:18:03,050] INFO - sessionId=8AD487DD-DB3F-4C3E-AB9A-302ABF05E6FC code=NewsStandPushCompleted startedBackgroundDownload=true

I would like to find all the sessionIds where startedBackgroundDownload=false from the second event and externalSignInStatus=true from the first event.

I think I would be able to do this with a subsearch, but nothing I've tried has resulted in anything but 0 matching events. Can anyone help me with a subsearch that would do what I need?

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion

A transaction based on sessionID might a better solution :

yourinitialsearch | transaction sessionId startswith="externalSignInStatus=true" endswith="startedBackgroundDownload=false" 
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...