SPL Search - Alert if not true (transaction)

[willadams]

I have written a rule that is trying to use a transaction and based on the transaction value to either alert or not.  For example the main fields I have in my index are as follows:

• rid
• label
• title

rid would be the common field and each rid could have from 2-5 events.  For example:

• Event 1 --> Aug 10 00:10:00 ......... label="News" Title="mytitle" user="bob" rid=12345
• Event 2 --> Aug 10 00:10:00 ......... label="Catalog" Title="mytitle"  user="bob" rid=12345
• Event 3 --> Aug 10 00:10:00 ......... label="Match" Title="mytitle"  user="bob" rid=12345

The search I have configured is as follows:

index=main NOT (sender="administrator" AND label="System Generated") NOT label="Match" | transaction rid

If I run the above search my transaction shows 2 of the events as above and removes Event 3.  What I am trying to do is alert on rid's where they have not yet been labelled "Match".  However the above search would trigger for ones that have already been matched.  An example may be

• Event 1 --> Aug 10 00:12:00 ......... label="News" Title="mytitle" user="bob" rid=45678
• Event 2 --> Aug 10 00:12:00 ......... label="Catalog" Title="mytitle"  user="bob" rid=45678

So using the examples above, I want to be able to alert when rid "45678" occurs but not "12345".

I have tried using a ....| transaction rid keepevictions=true and then searching for where this doesn't occur.  I have also tried the following which doesn't seem to garner the results I want.

index=main NOT (sender="administrator" AND label="System Generated") 
| transaction startswith="News" endswith="Match" mid
| search NOT label IN ("Match")

This generates 0 results.  I have also tried running with keepevicted=true with no results either

index=main NOT (sender="administrator" AND label="System Generated") NOT label="Match" | transaction rid keepevicted=true 

[bowesmana]

You can do it this way

| makeresults
| eval _raw="D,label,Title,user,rid
Aug 10 00:10:00,News,mytitle,bob,12345
Aug 10 00:10:00,Catalog,mytitle,bob,12345
Aug 10 00:10:00,Match,mytitle,bob,12345
Aug 10 00:12:00,News,mytitle,bob,45678
Aug 10 00:12:00,Catalog,mytitle,bob,45678"
| multikv forceheader=1
| eval _time=strptime(D,"%b %d %H:%M:%S")
| eval comment="Data setup for example up to here"
| table _time label Title user rid
| search NOT (sender="administrator" AND label="System Generated") 
| transaction rid
| where isnull(mvfind(label,"Match"))

HOWEVER, there are almost always a way to avoid using transaction, which has a number of side effects when dealing with larger data sets and longer 'transaction' durations.  See this example shows how a simple stats does the same trick.

| makeresults
| eval _raw="D,label,Title,user,rid
Aug 10 00:10:00,News,mytitle,bob,12345
Aug 10 00:10:00,Catalog,mytitle,bob,12345
Aug 10 00:10:00,Match,mytitle,bob,12345
Aug 10 00:12:00,News,mytitle,bob,45678
Aug 10 00:12:00,Catalog,mytitle,bob,45678"
| multikv forceheader=1
| eval _time=strptime(D,"%b %d %H:%M:%S")
| table _time label Title user rid
| search NOT (sender="administrator" AND label="System Generated") 
| stats values(label) as label values(Title) as Title values(user) as user by rid
| where isnull(mvfind(label,"Match"))

Hope this helps