Splunk Search

How to write a search to omit transactions unless the URLs are different in the transaction?

edookati
Path Finder

I am using the below query, but i need to omit the transactions unless the URLs are different in the transaction.

index=olb_logs sourcetype="access-API" (URL="/bankapi/session" method=POST ) OR (URL="/bankapi/accounts" method=GET) | transaction sessionID maxspan=3s

Thanks.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Your URLs likely are stored in a multi-value field, so you can exploit that to filter:

... | where mvcount(URL) > 1

Alternatively, if you have to make sure two specific URLs are present, you can again use the multi-value property to filter like this:

... | search URL="/bankapi/session" URL="/bankapi/accounts"

Note, that's using an implicit AND instead of OR... both will yield true for the transactions you want because the MV field contains both values.

0 Karma

somesoni2
Revered Legend

It would be helpful if you can post some sample events and your expected output of transaction command.

0 Karma

somesoni2
Revered Legend

Try this

index=olb_logs sourcetype="access-API" (URL="/bankapi/session" method=POST ) OR (URL="/bankapi/accounts" method=GET) | dedup URL| transaction sessionID maxspan=3s
0 Karma

edookati
Path Finder

even this is not giving me accurate results.
Thanks a lot, for the response.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...