Splunk Search

Search all events between start/stop event

huaraz
Explorer

Hi

I have logfiles where I have a start event and a stop event and I would like to search for all events between these two events. The start and stop event can repeat multiple times. Is that possible ? It would allow me to create a virtual session from start to stop.

Thank you
Markus

Tags (2)
0 Karma
1 Solution

acdevlin
Communicator

I think you should use the transaction command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

With the "startswith" and "endswith" options, you should be able to do what you want.

| transaction startswith="startEvent" endswith="endEvent" 

This should take any events between a starting event and an ending event, then group them together into transactions. I did something similar on my end recently to simulate user sessions on an internal server; transaction is a very useful command for this purpose!

View solution in original post

0 Karma

acdevlin
Communicator

I think you should use the transaction command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

With the "startswith" and "endswith" options, you should be able to do what you want.

| transaction startswith="startEvent" endswith="endEvent" 

This should take any events between a starting event and an ending event, then group them together into transactions. I did something similar on my end recently to simulate user sessions on an internal server; transaction is a very useful command for this purpose!

0 Karma

MarioM
Motivator

did you try the Transaction Command with startswith endswith options?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...