Splunk Search

How to get the first transaction after an event of a different kind occurs (e.g. service starts up)?


I want to find the first transaction that occurs after a different type of event.

Let's say we have this event:

"Service ready"

Then we have these events:

traceId=123 "Authentication started"

traceId=123 "Authentication complete"

I want to find this transaction:


| transaction traceId startswith="Authentication started" endswith="Authentication complete"

But I want to filter these transaction and only see the first one that occurs after the "Service ready" event.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...