I have an issue where my transaction search finds endswith events with no startswith events.
Not to go into too much detail but this is due to a funky way that Cisco logs OSPF events when DMVPN is involved.
I want to simply ignore endswith matches if a startswith event doesn't exist.
Is there a way to force transaction to only match if a startswith event exists (must startswith)?
Below is my search:
sourcetype=cisco:ios eventtype="cisco_ios-routing-ospf" | transaction host startswith="FULL to DOWN" endswith="LOADING to FULL" keepevicted=true | search closed_txn=0
transaction like this:
index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="cisco:ios" AND eventtype="cisco_ios-routing-ospf" | streamstats count(eval(searchmatch(FULL to DOWN"))) AS sessionID | streamstats count(eval(searchmatch(LOADING to FULL"))) AS endsWithPos BY sessionID | eventstats count(eval(searchmatch(LOADING to FULL"))) AS endsWithCount BY sessionID | search endsWithPos = endsWithCount | stats rante(time) AS duration BY sessionID
What are the values of the 'closed_txn' and '_txn_orphan' fields for the transactions missing
startswith events? If the former is non-zero, add the
keeporphans option to the transaction; if the latter is non-zero, use
Thanks for your reply. The value for keepevicted is non zero and for some reason keeporphans returns no value at. The problem I see with the keepevicted approach is that it cannot distinguish between startswith and endswith. I only want to ignore incomplete transactions where endswith is present with no startswith. However, I do want to know when a startswith value is found and no endswith value is found. When I set keepevicted to false, both endswith and startswith are ignored.