Splunk Search

Is there a way to detect a particular series of consecutive events that are interrupted by other events?

juliafum
New Member

Hello,

Is there a way to detect a particular series of consecutive events that are interrupted by other events?

I have data like...

timestamp   Event
01.01.2018  A
02.01.2018  X
03.01.2018  X
04.01.2018  B
05.01.2018  X
06.01.2018  X
07.01.2018  X
08.01.2018  B

...and I want to detect the sequences A B A, which I would add as a flag field.

Tags (1)
0 Karma

DalJeanis
Legend

There are two different parts to your question.

First, can you detect a series of events that have other events interspersed? Yes, of course.

Second, can you "mark" them or flag them? In a search, yes. However, not in terms of a data model or tags, since those are based on individual events.

In order to give you the best advices, we would need more information on the sequence. You said A > B > A, but your data shows only A > B > B.

This search is likely to use a streamstats command of some sort.

Let's suppose you only care when an A changes to B or back to A. Here's a run-anywhere example that marks the records you want to flag.

| makeresults
| eval mydata="01.01.2018,A;02.01.2018,X;03.01.2018,Q;04.01.2018,B;05.01.2018,G;06.01.2018,X;07.01.2018,R;08.01.2018,B;09.01.2018,A;"
| makemv delim=";" mydata
| mvexpand mydata
| makemv delim="," mydata
| eval _time=strptime(mvindex(mydata,0),"%m.%d.%Y")
| eval Event=mvindex(mydata,1)
| eval Host="test"
| table _time Event Host
| rename COMMENT as "The above enters your test data. We've added a key (Host) in case you have multiple sets of data at one time"

| rename COMMENT as "Mark the events we care about"
| eval checkme=case(Event="A",Event, Event="B",Event)

| rename COMMENT as "Copy the related values forward, only on the records we care about."
| streamstats current=f last(checkme) as lastcheck by Host

| rename COMMENT as "If the values exist and have changed, flag the event."
| eval flagme=case(lastcheck!=checkme,"Y")

That's it. Replace by Host with the keys you care about, or eliminate it completely if you only need to process one set of transactions at a time.

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

Is it just A -> B -> A to be detected what about B -> A -> B or any other combinations of events?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...