Splunk Search

How to write a search to count variations (different order and number) of transaction events?

adamguzek
Explorer

I need a search to count variations of event occurance. Lets say we have events:
A,B,C,D,E which are combined into transaction by sessionid.
Event A is a start
Event E is an end.

In time, I have to search for transactions which have a different order and number of middle steps:
ABCDE
ACBDE
ABCDBCDE
and so on...

I need a stats count how many all of variations have occurred... I cannot predict all of the possible variations as steps are repeating between start and stop.

I need a table:
VARIANT - COUNT
ABCDE - 10
ABBE - 3
etc...

Any useful searches/commands I can try?

0 Karma

HiroshiSatoh
Champion

Try this!

your search | transaction  startswith=A endswith=E|eval VARIANT=mvjoin(event, "-")|stats count by VARIANT
0 Karma

woodcock
Esteemed Legend
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...