Splunk Search

How do I merge events on the basis of time and fields?

pratibha2018
Explorer

I want to merge events that are in between state=" STARTED" and state="COMPLETED" i.e. All the following events of state="STARTED" and preceding to state="COMPLETED" will merge into a single event.

0 Karma

tiagofbmm
Influencer

Hey

Do you have any field that may connect those events? Like an ID?

Then you could use transaction command with these parameters

endswith
Syntax: endswith=<filter-string>
Description: A search or eval expression which, if satisfied by an event, marks the end of a transaction.

startswith
Syntax: startswith=<filter-string>
Description: A search or eval filtering expression which if satisfied by an event marks the beginning of a new transaction.

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction

0 Karma

pratibha2018
Explorer

No Nothing to match.

0 Karma

tiagofbmm
Influencer

Well and to you have events starting in between the others?

I mean:

event A started at X and ended at Y
event B starter at X+5 and ended at Y+3

Do you also have those scenarios?

0 Karma

pratibha2018
Explorer

There is the start time for each event, not the end time. And also not necessary that the event B start at X+5 .

So, In my case eventA gives me the log that Request1 started for user1
eventB gives me that Request2 has completed in time(* sec) for user2
And If there is any Error then another EventC is created in between A and B with Error log.
Now, I just want table "Error log" User.

Is this possible??

0 Karma

tiagofbmm
Influencer

I don't see that possible if you don't have an element to trace the events back.

Can you show us a piece of your log with the events you mentioned?

0 Karma

pratibha2018
Explorer

Here's the code :

2018-02-09 18:10:25,542 INFO [qtp1687849576-8861]: "class name1" - [#0000e4ca] "Request1" from "ip_address1" ("email_id1") STARTED
2018-03-09 18:10:26,610 ERROR [qtp1687849576-12683]: "class name2" - Cannot retrieve. No UserLoginHistory information is stored.
2018-02-09 18:10:28,760 INFO [qtp1687849576-8861]: "class name1" - [#0000e4ca] "Request1" from "ip_address1"("email_id1") COMPLETED in 0.217s

0 Karma

p_gurav
Champion

Did you extract this "qtp1687849576" into field say abc and then
Can you try :

| transaction abc startswith="STARTED" endswith="COMPLETED"

0 Karma

pratibha2018
Explorer

Thanks @p_gurav
But can't rely on this "qtp..." thing.

0 Karma

p_gurav
Champion

Is there any other common field present in logs?

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...