Splunk Search

How to edit my search to find events that did not occur right before a machine restart?

Communicator

I'd like to look for events of a Windows service stopping but ONLY if it did not occur while the machine was being rebooted. So far I have:

index=wineventlog  sourcetype=wineventlog:system (EventCode=7036 "Service Name" stopped) OR EventCode=6009
| transaction ComputerName startswith="EventCode=7036" endswith="EventCode=6009" maxspan=10m

EventCode 7036 is the service stopping while an EventCode 6009 occurs when the machine has just rebooted. This currently shows all the stops WITH a restart but I would like to find event 7036 when there was not a 6009 within about 10 minutes.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this

index=wineventlog  sourcetype=wineventlog:system (EventCode=7036 "Service Name" stopped) OR EventCode=6009
| transaction ComputerName startswith="EventCode=7036" endswith="EventCode=6009" maxspan=10m keeporphan=t
| where duration>600 OR (mvcount(EventCode)=1 AND EventCode="7036")

View solution in original post

0 Karma

Ultra Champion

try

 index=wineventlog  sourcetype=wineventlog:system (EventCode=7036 "Service Name" stopped) OR EventCode=6009 | transaction ComputerName startswith="EventCode=7036" endswith="EventCode=6009" maxspan=10m keeporphans=true|search _txn_orphan=1
0 Karma

SplunkTrust
SplunkTrust

Try this

index=wineventlog  sourcetype=wineventlog:system (EventCode=7036 "Service Name" stopped) OR EventCode=6009
| transaction ComputerName startswith="EventCode=7036" endswith="EventCode=6009" maxspan=10m keeporphan=t
| where duration>600 OR (mvcount(EventCode)=1 AND EventCode="7036")

View solution in original post

0 Karma

Communicator

Thanks very much! This looks like it works perfectly. Didn't realize you could keep the other results with keeporphans.

0 Karma