Splunk Search

How to avoid unwanted nested transactions?

TRJR
Engager

Hi - I have a list of events, most of which pair up nicely as 'startswith' (A) and 'endswith' (B) to make a desired transaction, but in the list there is an extra unexpected 'startswith' event and an extra unexpected 'endswith'.  The extra unexpected events  are shown in the list below as bold and underlined.

A B A B A B A A B A B A B A B A B A B B A B A B A B 

Because there is one of each they match together they are not orphans and they make one very long false transaction, with a large number of valid transactions nested inside it.  I thought limiting maxevents to 2 would help, but it didn't, and because a valid transaction *could* be a long duration then I don't want to use maxspans.  Is there some way to ignore events which are out of sequence?   I appreciate that choosing *which* of the adjacent events should be ignored might be problematic i.e. it could be the second not first 'A', but am first interested in what is possible. 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could use streamstats to capture the previous event type and drop events where the type is the same as the previous

Depending on whether you wanted to keep only the last A or first B you may have to do this twice with a reverse between to change the order of the events.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could use streamstats to capture the previous event type and drop events where the type is the same as the previous

Depending on whether you wanted to keep only the last A or first B you may have to do this twice with a reverse between to change the order of the events.

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...