Splunk Search

Recursively Search Until Condition

mrstrozy
Path Finder

Hi,

I am looking for a way to connection multiple events with two corresponding values together until I hit a condition of where there isn't a second corresponding value. Let me explain further. The data might look like this:

Event 1: current=1 new=2
Event 2: current=2 new=3
Event 3: current=3 new=4
.....
.....
Event 10: current=10 new=null

What I am looking to do is get to Event 10 from Event 1 and end with the value of 10. Basically this is a situation where an event might be the updating of an id, and only in that event is there a connection between the old id and the new id. This can happen several times and so in order to track the whole picture in splunk, I will need to start at the beginning and chain together all the events until I get to the event where the "new" id is nothing thus telling me that I'm at the end.

Any help or insight to this problem would be much appreciated.

Thank you for your help!

0 Karma

skalliger
Motivator

You may want to take a look at the transaction command and the options "startswith" and "endswith".

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...