Splunk Search

How can I remove one of event from transaction result

New Member

Recently i create a transaction search, command and result a per below
Search command:
search | transaction SessionId srcip destip starttime mvlist=t maxspan=5m keepevicted=true

Result table as per below:
alt text

May i know how to filter/remove those SessionEstablish="Success" and SessionCode="Drop" when eventcount is more than 1 and SessionType is MultiMode?

Thanks in advance.

0 Karma
1 Solution

Motivator

You can add a filter condition after your search like this:

| search eventcount=1 OR (eventcount>1 AND SessionType="MultiMode" AND NOT (SessionEstablish="Success" AND SessionCode="Drop"))

View solution in original post

Esteemed Legend

The basic answer is DO NOT USE transaction. It is massive overkill, does not scale well, and when it tries to, it silently fails without telling you that it gave up in the middle. If it seems to work for you, I assure you that you are mistaken. Take a step back, post a set of raw events and then tell us what you are trying to do with them. We will give you an answer that does not use transaction.

0 Karma

Motivator

You can add a filter condition after your search like this:

| search eventcount=1 OR (eventcount>1 AND SessionType="MultiMode" AND NOT (SessionEstablish="Success" AND SessionCode="Drop"))

View solution in original post

New Member

Hi DMohn, i had posted new comment waiting moderator review my post

0 Karma

New Member

alt text

The Result was appear as per above attached, however i wish to get as per below result

alt text

0 Karma

Motivator

This is not what you had described in your starting post ... If I comapre the initial screenshot with the one you posted as your "intended result", you only removed the "SessionCode = Drop" events. Is this what you are trying to do? If not, please go into detail a bit more and elaborate, which results you want to see (or not) - e.g. SessionType = Single or Multi, Session Code = ....

0 Karma