How to group transactions and multiple timeout logs by deviceId and deviceType?

[AlexMcDuffMille]

Hello,

I am monitoring several different devices simultaneously and have several log files in a row that say "action=inactivity_timeout" for each device. The timeout log gets generated every ~80 seconds or so with no activity. I would like to be able to group transactions based on the deviceId and deviceType and group multiple timeout logs together by deviceId and deviceType so I can see how many times the device times out.

For example, this would just be two 'timeout' entries. I have other devices reporting logs too, but I think I can filter them out to get a big picture view:

deviceId=1 deviceType=A action=activity

deviceId=1 deviceType=A action=inactivity_timeout

deviceId=1 deviceType=A action=inactivity_timeout

deviceId=1 deviceType=A action=activity

deviceId=1 deviceType=A action=activity

deviceId=1 deviceType=A action=activity

deviceId=1 deviceType=A action=inactivity_timeout

deviceId=1 deviceType=A action=inactivity_timeout

Thank you!

[somesoni2]

Try something like this

your base search | streamstats last(action) as prevAction current=f window=1 by deviceType | where NOT (action="inactivity_timeout" AND prevAction="inactivity_timeout") | fields - prevAction

[AlexMcDuffMille]

Yes, those are examples of log events.

All of the different devices go to a central server, and the central server goes to a single index in Splunk. I am not able to install a forwarder on the devices themselves.

I think your search will count the number of inactivity_timeouts, but there will be times when the device is not used for an extended period of time and multiple logs like that will be created by the same device, so I'll need to combine them all into one event. Does that make sense?

Thanks!

[strive]

Are these are your log events?
deviceId=1 deviceType=A action=inactivity_timeout

Are you sending logs from all the devices to a single index?

Assuming your answer as Yes for my questions. See if this works:
Some Search Terms... action="inactivity_timeout" | stats count as TimeOuts by deviceId deviceType