Splunk Search

How find events where "event.action"="START" AND no corresponding event where "event.action"="FINISH".?

hooligeek
Observer

Given the example events below.  ALL field values match with the exception of the "event.action" field. 

 

{"event": {"action":"START","date":"DATE","title":"TITLE","user":"USER"}}

{"event": {"action":"FINISH","date":"DATE","title":"TITLE","user":"USER"}}

 

I'm trying to find events where "event.action"="START" AND no corresponding event where "event.action"="FINISH". 

 

Both events should have the same "event.title" and "event.user".

Labels (2)
0 Karma

hooligeek
Observer

Same.  If you update your initial suggestion, I'll accept the solution.  :beaming_face_with_smiling_eyes:

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Do a stats values(event.action) by any combination of other fields that you need (event.title, event.user or whatever else you have there).

You'll get a multivalued field on which you'll be able to search for any (or both) action.

| stats values(event.action) as action by event.title event.user | search event.action="START" event.action="FINISH"
0 Karma

hooligeek
Observer

Thank you,

This helped me push forward with a little tweak.  

Instead of :

| search event.action="START" event.action="FINISH"

 Idid 

| where action="START" action!="FINISH"

This provided me a list of occurrences with a START event and no FINISH event which is exactly what I was after.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Ahhh, you wanted start with no finish... right. :slightly_smiling_face:

I sometimes read too quickly :winking_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...