Splunk Search

How to get transaction to ignore endswith if startswith doesn't exist

mikecal
Explorer

I have an issue where my transaction search finds endswith events with no startswith events.

Not to go into too much detail but this is due to a funky way that Cisco logs OSPF events when DMVPN is involved.

I want to simply ignore endswith matches if a startswith event doesn't exist.

Is there a way to force transaction to only match if a startswith event exists (must startswith)?

Below is my search:

sourcetype=cisco:ios eventtype="cisco_ios-routing-ospf" | transaction host startswith="FULL to DOWN" endswith="LOADING to FULL" keepevicted=true | search closed_txn=0

Thanks,
Mike

0 Karma

woodcock
Esteemed Legend

Ditch transaction like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="cisco:ios" AND eventtype="cisco_ios-routing-ospf"
| streamstats count(eval(searchmatch(FULL to DOWN"))) AS sessionID
| streamstats count(eval(searchmatch(LOADING to FULL"))) AS endsWithPos BY sessionID
| eventstats count(eval(searchmatch(LOADING to FULL"))) AS endsWithCount BY sessionID
| search endsWithPos = endsWithCount
| stats rante(time) AS duration BY sessionID
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What are the values of the 'closed_txn' and '_txn_orphan' fields for the transactions missing startswith events? If the former is non-zero, add the keeporphans option to the transaction; if the latter is non-zero, use keepevicted=false.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mikecal
Explorer

Thanks for your reply. The value for keepevicted is non zero and for some reason keeporphans returns no value at. The problem I see with the keepevicted approach is that it cannot distinguish between startswith and endswith. I only want to ignore incomplete transactions where endswith is present with no startswith. However, I do want to know when a startswith value is found and no endswith value is found. When I set keepevicted to false, both endswith and startswith are ignored.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...