Splunk Search

How to find last of A and first of B in one query?

mrhodes93
Explorer

Considering the following two messages:

 

sourcetype="PCF:log" cf_app_name=app1 msg="launch processing started" UserID: ABC

sourcetype="PCF:log" cf_app_name=app1 msg="flow complete" UserID: ABC

 

 

I want to capture the elapsed time between the earliest occurrence of "launch processing started", and the latest occurrence of "flow complete", by matching on UserID (which I've regex extracted to a field).  How would I approach this? 

Edit: I should mention this is timeboxed to one day. If a user launches but doesn't complete in a day, I don't care.

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That's a textbook example of the transaction command.  Note, this does not handle nested start/stop event pairs.

index=foo ("launch processing started" OR "flow complete")
`comment("Insert rex command that extracts UserID field")`
| transaction UserID startswith="launch processin started" enswith="flow complete"
| table UserID duration

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

That's a textbook example of the transaction command.  Note, this does not handle nested start/stop event pairs.

index=foo ("launch processing started" OR "flow complete")
`comment("Insert rex command that extracts UserID field")`
| transaction UserID startswith="launch processin started" enswith="flow complete"
| table UserID duration

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

mrhodes93
Explorer

This is fantastic, I'm fairly new to splunk and was not aware of transaction.  It seems as though it overcomes an issue like:

launch, complete, launch (exit without completing)

The second launch without a complete is not considered part of the transaction, hence the time is discarded from the calculation.  Am I understanding that correctly? 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you are understanding it correctly.

Be aware, though, that the transaction command can be slow.

---
If this reply helps you, an upvote would be appreciated.
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!