Splunk Search

How to find incomplete transactions outside of a 30 day period

metersk
Path Finder

In the query below I am trying to find all users who logged in and then did not login again with in the time range. Unfortunately, is is not returning any results, which I know to be wrong by verifying for a specific UID.

earliest=-2d@d latest=-0d@d msg=login_daily `money_countries` | transaction uid startswith=(msg="login_daily") endswith=(msg="login_daily") keepevicted=true | search closed_txn=0 | table uid

Once I can get this working, I would like to find only unclosed transactions where there the absence of a second login comes 30 days after the first login. Is this possible?

0 Karma

woodcock
Esteemed Legend

You can do this with transaction but it is inefficient. I am not entirely sure I understand what you are trying to do (the confusion comes from the fact that your startswith and endswith strings are identical), but I think this will do it:

 msg=login_daily `money_countries` | streamstats latest(_time) BY uid AS prevTime | eval SecondsSincePrevEventByUID=(_time - prevTime) | where SecondsSincePrevEventByUID>=2592000

This adds a prevTime to each event that is the time of the previous event matching the same uid. If we then subtract these times, we can filter in those events that are 30 days (2592000 seconds) apart.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...