How do I merge events on the basis of time and fields?

[pratibha2018]

I want to merge events that are in between state=" STARTED" and state="COMPLETED" i.e. All the following events of state="STARTED" and preceding to state="COMPLETED" will merge into a single event.

[tiagofbmm]

Hey

Do you have any field that may connect those events? Like an ID?

Then you could use transaction command with these parameters

endswith
Syntax: endswith=<filter-string>
Description: A search or eval expression which, if satisfied by an event, marks the end of a transaction.

startswith
Syntax: startswith=<filter-string>
Description: A search or eval filtering expression which if satisfied by an event marks the beginning of a new transaction.

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction

[pratibha2018]

No Nothing to match.

[tiagofbmm]

Well and to you have events starting in between the others?

I mean:

event A started at X and ended at Y
event B starter at X+5 and ended at Y+3

Do you also have those scenarios?

[pratibha2018]

There is the start time for each event, not the end time. And also not necessary that the event B start at X+5 .

So, In my case eventA gives me the log that Request1 started for user1
eventB gives me that Request2 has completed in time(* sec) for user2
And If there is any Error then another EventC is created in between A and B with Error log.
Now, I just want table "Error log" User.

Is this possible??

[tiagofbmm]

I don't see that possible if you don't have an element to trace the events back.

Can you show us a piece of your log with the events you mentioned?

[pratibha2018]

Here's the code :

2018-02-09 18:10:25,542 INFO [qtp1687849576-8861]: "class name1" - [#0000e4ca] "Request1" from "ip_address1" ("email_id1") STARTED
2018-03-09 18:10:26,610 ERROR [qtp1687849576-12683]: "class name2" - Cannot retrieve. No UserLoginHistory information is stored.
2018-02-09 18:10:28,760 INFO [qtp1687849576-8861]: "class name1" - [#0000e4ca] "Request1" from "ip_address1"("email_id1") COMPLETED in 0.217s

[p_gurav]

Did you extract this "qtp1687849576" into field say abc and then
Can you try :

| transaction abc startswith="STARTED" endswith="COMPLETED"

[pratibha2018]

Thanks @p_gurav
But can't rely on this "qtp..." thing.

[p_gurav]

Is there any other common field present in logs?