Splunk Search

How can I find the reoccurring group of transactions over time?

RocIngersol
Explorer

Hey Folks,

I have a transaction search that "groups" various things of interest (5m maxspan etc ). I was wondering - how could I count the reoccurrences of transaction groups over time? Some sort of eval I guess but ain't sure....

thx,
R

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@RocIngersol - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

woodcock
Esteemed Legend

Using transaction causes many metadata fields to be created including eventcount which is exactly what you need. Once the search completes, in the events area, to the left aligned with the the first line of each transaction, in the i column, you should see a > character. Click on this and it will become a v character. Then scroll down to the bottom of your event to see a wonderful land of insight showing each field/value that exists for this event, even the uninteresting ones.

0 Karma

DalJeanis
Legend

Can you give a specific example of what you would call a recurrence? That description or example is going to determine how you need to treat the data in order to be able to find that recurrence.

0 Karma

RocIngersol
Explorer

Sure, thx. So my transaction search runs and I get lots of "grouped events" by my criteria and max span etc. So while that's valuable I want to count the occurrences of each transaction group over time. I tried building a new field after transaction with eval newIDfield=field1+field2 But that results in some newIDfield being blank when there are multiple different values for field1 out of the transaction..

Hope that is clearer! I'll post my search when I'm online later if not.

R

0 Karma

DalJeanis
Legend

The search itself would help. The main question is, how do you (as a data consumer) know that a later transaction is a recurrence of an earlier one, as opposed to a closely similar but different transaction?

0 Karma

woodcock
Esteemed Legend

You probably need timechart, maybe ... | timechart count BY host added to your existing search.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...