Splunk Search

Recursively Search Until Condition

mrstrozy
Path Finder

Hi,

I am looking for a way to connection multiple events with two corresponding values together until I hit a condition of where there isn't a second corresponding value. Let me explain further. The data might look like this:

Event 1: current=1 new=2
Event 2: current=2 new=3
Event 3: current=3 new=4
.....
.....
Event 10: current=10 new=null

What I am looking to do is get to Event 10 from Event 1 and end with the value of 10. Basically this is a situation where an event might be the updating of an id, and only in that event is there a connection between the old id and the new id. This can happen several times and so in order to track the whole picture in splunk, I will need to start at the beginning and chain together all the events until I get to the event where the "new" id is nothing thus telling me that I'm at the end.

Any help or insight to this problem would be much appreciated.

Thank you for your help!

0 Karma

skalliger
Motivator

You may want to take a look at the transaction command and the options "startswith" and "endswith".

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...