How to write a search to display events that do not have a corresponding event with a condition that negates them?

[evan_roggenkamp]

I want to write a search that returns results in a time frame that is conditional in this manner:

Event A: If field1 = [unique_item {arbitrary ID: 000}] and field2 = 1 then [display this event]
Event B: If field1 = [unique_item {arbitrary ID: 000}] and field2 = [0] then [do not display this event or Event A]

Event C: If field1 = [unique_item {arbitrary ID: 001}] and field2 = 1 then [display this event]
Event 😧 If field1 = [unique_item {arbitrary ID: 001}] and field2 = [0] then [do not display this event or Event C]

Event E: If field1 = [unique_item {arbitrary ID: 002}] and field2 = 1 then [display this event]
Event F: If field1 = [unique_item {arbitrary ID: 002}] and field2 = [0] then [do not display this event or Event E]

And so on. "Field 1" doesn't not necessarily need to be assigned an ID, I just put that there to illustrate that the value of this field could really be anything. "Field2" will always either be a 1 or a 0.

This is very similar to the question posed here:
https://answers.splunk.com/answers/137069/find-all-events-not-having-a-corresponding-event-matched-b...
But I do not have a unique ID per event that will be the same despite field2's value, so I can not make use of the solution there.

Thanks

[gwobben]

How about a transaction? Try something like this:

<your search> | transaction field1 startswith=field2=1 endswith=field2=0 keepevicted=t

A requirement is that there is something that connects the events (like an ID of some sort). It doesn't really matter what field1 is, as long as it's the same for event A and B or C and D ... If this is not the case in your data your only chance is to connect events based on a time interval (e.g. B happens always .. seconds after A).

The keepevicted flag will make sure that events that do not match the startswith and endswith conditions are flagged, so you can filter them later.

[evan_roggenkamp]

Great!

It seems my search is returning what I would like, I just need to filter out the results that have both "Active" and "Cleared" as their Field2 value. I am a little unsure on how to search the fields that are returned by the keepevicted flag.

http://i.imgur.com/pElFKY1.png

[maciep]

is field1 the same between events A&B? Likewise with pairs C&D and E&F? Are there always just two events that would share that field1?

Initial thought would be do something like

... | stats values(field2) as field2 by field1 | where NOT match(field2,"0") | ....

[evan_roggenkamp]

field1 will be the same, (but WITHIN similar sets, A&B, C&D, etc.) and there may be multiple events with field1. For example, field1 is an alert description. Field2 is an active alert indicator that is either Active or Clear. The clear (0) negates the active condition, so I want to display events with an Active alert condition that have had no Clear to negate them.

[maciep]

sorry for the late reply, but it looks like you have a solution going with transaction, so that's good.