Splunk Search

How to group transactions and multiple timeout logs by deviceId and deviceType?

AlexMcDuffMille
Communicator

Hello,

I am monitoring several different devices simultaneously and have several log files in a row that say "action=inactivity_timeout" for each device. The timeout log gets generated every ~80 seconds or so with no activity. I would like to be able to group transactions based on the deviceId and deviceType and group multiple timeout logs together by deviceId and deviceType so I can see how many times the device times out.

For example, this would just be two 'timeout' entries. I have other devices reporting logs too, but I think I can filter them out to get a big picture view:

deviceId=1 deviceType=A action=activity

deviceId=1 deviceType=A action=inactivity_timeout

deviceId=1 deviceType=A action=inactivity_timeout

deviceId=1 deviceType=A action=activity

deviceId=1 deviceType=A action=activity

deviceId=1 deviceType=A action=activity

deviceId=1 deviceType=A action=inactivity_timeout

deviceId=1 deviceType=A action=inactivity_timeout

Thank you!

0 Karma

somesoni2
Revered Legend

Try something like this

your base search | streamstats last(action) as prevAction current=f window=1 by deviceType | where NOT (action="inactivity_timeout" AND prevAction="inactivity_timeout") | fields - prevAction
0 Karma

AlexMcDuffMille
Communicator

Yes, those are examples of log events.

All of the different devices go to a central server, and the central server goes to a single index in Splunk. I am not able to install a forwarder on the devices themselves.

I think your search will count the number of inactivity_timeouts, but there will be times when the device is not used for an extended period of time and multiple logs like that will be created by the same device, so I'll need to combine them all into one event. Does that make sense?

Thanks!

0 Karma

strive
Influencer

Are these are your log events?
deviceId=1 deviceType=A action=inactivity_timeout

Are you sending logs from all the devices to a single index?

Assuming your answer as Yes for my questions. See if this works:
Some Search Terms... action="inactivity_timeout" | stats count as TimeOuts by deviceId deviceType

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...