Splunk Search

How to Get An Event from Within a Transaction

Traer001
Path Finder

Hello,

I am trying to get an event inside of a transaction to use for duration calculation. My events currently look like this (for one user):

2021-06-07 17:53:01 UserId:123 Session complete
2021-06-07 17:25:01 UserId:123 Start session
2021-06-07 17:17:01 UserId:123 Choose location for session:231
2021-06-07 15:33:01 UserId:123 Session complete
2021-06-07 14:55:01 UserId:123 Start session
2021-06-07 14:42:01 UserId:123 Choose location for session:212

I want to get the duration of the session from start to completion but also need to session number. I set up my search with a transaction starting with the "Choose" event and ending with the "Session complete" event in order to get the session number with the grouping, but I need to access the "Start session" event to calculate the duration. How should I go about this? My search is below:

index=INDEX host=HOST sourcetype=SOURCETYPE earliest=-1d@d latest=now
| rex field=_raw "UserId:(?<user_id>\d+)\sSession\scomplete"
| rex field=_raw "UserId:(?<user_id>\d+)\sStart\ssession"
| rex field=_raw "UserId:(?<user_id>\d+)\sChoose\slocation\sfor\ssession:(?<session_id>\d+)"
| where user_id<3000
| sort 0 user_id -_time
| transaction user_id startswith="Choose" endswith="complete"

Labels (1)
0 Karma
1 Solution

Traer001
Path Finder

I managed to solve my issue by using filldown prior to the transaction:

index=INDEX host=HOST sourcetype=SOURCETYPE earliest=-1d@d latest=now
| rex field=_raw "UserId:(?<user_id>\d+)\sSession\scomplete"
| rex field=_raw "UserId:(?<user_id>\d+)\sStart\ssession"
| rex field=_raw "UserId:(?<user_id>\d+)\sChoose\slocation\sfor\ssession:(?<session_id>\d+)"
| where user_id<3000
| sort 0 user_id _time
| filldown session_id
| sort 0 user_id -_time
| transaction user_id startswith="Choose" endswith="complete"

View solution in original post

0 Karma

Traer001
Path Finder

I managed to solve my issue by using filldown prior to the transaction:

index=INDEX host=HOST sourcetype=SOURCETYPE earliest=-1d@d latest=now
| rex field=_raw "UserId:(?<user_id>\d+)\sSession\scomplete"
| rex field=_raw "UserId:(?<user_id>\d+)\sStart\ssession"
| rex field=_raw "UserId:(?<user_id>\d+)\sChoose\slocation\sfor\ssession:(?<session_id>\d+)"
| where user_id<3000
| sort 0 user_id _time
| filldown session_id
| sort 0 user_id -_time
| transaction user_id startswith="Choose" endswith="complete"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...