Splunk Search

Removing consecutive events with identical 'name' field but different timestamp in a transaction

merethhe
Engager

I run this search:

... | dedup userId name dt | transaction mvlist=t userId maxpause=900s | where mvindex(id, -1) == "1152921526082717650" | table name, dt

Which creates transactions based on userId that ends with the specified page id, and removes events that are equal in name and timestamp for each user. It gives me a result for instance like this:

A, 19:00:00
B, 19:00:30
C, 19:01:00
C, 19:01:35
B, 19:02:00

What I want to do now, is remove all events that follow an event with the exact same name, that is I want to remove the second "C" event. The problem is, I do NOT want to remove the second "B" event, even though it already occured in the transaction. This means that I can not use dedup on the (name, userId) combination.

Any suggestions?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

... | dedup userId name dt | transaction mvlist=t userId maxpause=900s | where mvindex(id, -1) == "1152921526082717650" | table name, dt | streamstats current=f window=1 first(name) as prevName | where name != prevName
0 Karma

merethhe
Engager

It did not work. 'prevName' seems to be set as the name of the first event from the previous transaction.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...