Splunk Search

Is there a way to make transaction wait or end before starting new transaction?

morganj1
Explorer

Hi, is there a way to make a Splunk transaction wait until it has ended, before starting another transaction.

 

e.g. if I have (with latest results at the top)

a end
b start
c start
d end
e end
f start
g start
h start

 

What I get from Splunk here would be transactions: f->e, g->d and b->a.

But what I want is h->e and c->a, so once it's found "start" it then looks for "end", and then looks for the next "start" after that... etc.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @morganj1,

it's possible if you have a field (e.g. transaction_id) to use as a correlation key to correlate events, if you use startswith and/or endswith options it isn't possible.

Anyway, if you have a field to use as key, see a different approach using the stats command instead transaction because the thansaction command is very slow!

Ciao.

Giuseppe

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You could also try to transform your data so that it keeps only the first "start" in a row (by using autoregress/streamstats to get previous value and only leave the "start" if it was preceeded by an "end")

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If you are sure that those 'in-between' events are useless, you can even use dedup to filter them out.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...