How do you find consecutive events in two different searches?

[funnysage]

Hi,

This is a newbie question.

I have two different searches. I want to combine the search results and only display a result where a certain event appears before another result.

For e.g.

Search1 : sourcetype=SourceType_A "Some str 1"
Search2 : sourcetype=SourceType_B "Some str 2"

Result set should be:
Some str 2
Some str 1

So I want to show only those instances where "Some str 1" is followed by "Some str 2" and time gap in within say 3 secs.

[nareshinsvu]

Check out below thread. I had similar query resolved using transaction command

https://answers.splunk.com/answers/714361/how-do-you-group-start-and-end-times-from-a-set-of.html

[funnysage]

Hi There,

Thanks for the feedback.
I used this criteria: (sourcetype=SourceType_A "Some str 1") OR (sourcetype=SourceType_B "Some str 2")|transaction maxspan=5s.
Using this i was able to group together the series of events that i was interested in. However, i am getting some extra events. My output looks something like this:

"Some str 1"
"Some str 1"
"Some str 1" <- event group that i am interested. I wanted this group as the output.
"Some str 2"
"Some str 1"

[bangalorep]

You can use the startswith and endswith option as well.
So your transaction command should look something like |transaction maxspan=5s startswith="some str 1" endswith = "some str 2"

[funnysage]

This works perfectly. Thanks.

[bangalorep]

Hello,
You can use the transaction command.
So essentially a search like (sourcetype=SourceType_A "Some str 1") OR (sourcetype=SourceType_B "Some str 2") will get the events in the same search.
You can then use the transaction command based on whats common among the events and use the maxspan option to specify the time gap you want.
Here is the documentation for the transaction command https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Transaction