Splunk Search

How does the pairing work in a transaction?

danielbb
Motivator

This one relates to How can we deal with a negation of a transaction?

We have this code -

 (index=wineventlog  OR 
 (index=checkpoint action=Accept) 
 | eval destination_ip = coalesce(Source_Network_Address,dest_ip) 
 | eval action-{index}= action 
 | eval src-{index}= src 
 | transaction destination_ip maxspan=60s startswith=action-checkpoint="Accept" endswith=action-wineventlog="success" keeporphans=1 unifyends=1 
 | search src-wineventlog = * AND src-checkpoint = * 
 | lookup(s) ....
 | table <fields>

We end up with one event from checkpoint bound in the transaction to one event from wineventlog. Meaning, each transaction is of two events from the two indexes. However, we realize that for one event from checkpoint, there are 12 possible candidates from wineventlog. All these 12 events stratify the criteria. So, how does the transaction command pick one of these 12 events? Is there logic for the choice?

Tags (2)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Splunk will use the first action-checkpoint="Accept" for an destination_ip and pair it with whatever data it finds in between using the same destination_ip till the first action-wineventlog="success" with that same destination_ip
in your case after 60s if it doesn't find a action-wineventlog="success"it will consider it an orphan transaction. The logic here is time based.

If you want to check all the end possibilities consider using |stats instead of |transaction. Not only you can probably accomplish the same task, but you'll get way better performance doing it.

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

Splunk will use the first action-checkpoint="Accept" for an destination_ip and pair it with whatever data it finds in between using the same destination_ip till the first action-wineventlog="success" with that same destination_ip
in your case after 60s if it doesn't find a action-wineventlog="success"it will consider it an orphan transaction. The logic here is time based.

If you want to check all the end possibilities consider using |stats instead of |transaction. Not only you can probably accomplish the same task, but you'll get way better performance doing it.

------------
Hope I was able to help you. If so, some karma would be appreciated.

danielbb
Motivator

It does make sense.

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...