Splunk Search

How to write a complex transaction Search

vasanthmss
Motivator

Hi There,

Identify the transaction duration based on individual field, field3,fiel4 values. Events may not be same as below sample, events may be indexed like a,b,a,a,a,b,b,c.

Transaction Rule,

Transaction starts when the events field1, field2 has 1,0 with continuous field1,fiel2 has 1,1 then pick the first event time.
Transaction ends with either field1,fiel2 has 8,0 or 9,0.

Sample Events,

time    field   field1 field2 field3 field4 
.   a   1   0   xx  xx *
.   a   1   1   xx  xx 
    a   1   0   xx  xx
    a   2   1   xx  xx
    a   1   0   xx  xx  
    a   9   0   xx  xx *

    a   1   0   xy  xx *
    a   1   1   xy  xx
    a   1   0   xy  xx
    a   2   1   xy  xx
    a   1   0   xy  xx  
    a   8   0   xy  xx *

    b   1   0   xx  xx *
    b   1   0   xx  xx  
    b   1   0   xx  xx
    b   1   1   xx  xx
    b   x   x   xx  xx
    .
    .
    .
    b   9   8   xx  xx
    b   8   0   xx  xx *

Expected Results,

field   fiele2  field3  duration
a   xx      xx      10:00
a   xy      xy      5:00
b   xx      xx      15:00
V
Tags (2)
1 Solution

emiller42
Motivator

You didn't explicitly mention it, but it's implied by your example, that the transaction is grouped on field. (a, b, c, etc) That being the case, the below should work for you. The startswith and endswith params are treated like searches when surrounded by parens, which lets this work. Note that depending on how long your transactions actually are, you may need to also set maxevents or maxspan as well.

... | transaction field startswith=(field1=1 AND field2=0) endswith=((field1=8 OR field1=9) AND field2=0)

*note: the AND's in the above are technically redundant, but included for clarity

View solution in original post

emiller42
Motivator

You didn't explicitly mention it, but it's implied by your example, that the transaction is grouped on field. (a, b, c, etc) That being the case, the below should work for you. The startswith and endswith params are treated like searches when surrounded by parens, which lets this work. Note that depending on how long your transactions actually are, you may need to also set maxevents or maxspan as well.

... | transaction field startswith=(field1=1 AND field2=0) endswith=((field1=8 OR field1=9) AND field2=0)

*note: the AND's in the above are technically redundant, but included for clarity

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...