Splunk Search

Transaction Duration Duplicated due to multiple same event

YoussefB
Engager

Hello,

I'm trying to get the duration of a transaction starting with "green" and stopping with "red" :
The problem is that when i have data like this :

  • time_001 Green
  • time_002 Green
  • time_003 Red
  • time_004 Red
  • time_005 Green
  • time_006 Red
  • time_007 Green
  • time_008 Green
  • time_009 Red

The calculated duration is ko because of the duplicated events.
This is my search query :
host="Data_Host" "Connected"
| rex ="Host (?.) - (?.)"
| transaction host startswith="*Green
" endswith="Red"
| stats sum(duration) as "uptime_duration" by ligneNum
| convert timeformat="%d/%m/%y-%H:%M:%S" ctime(_time) AS "uptime_duration"
| fieldformat uptime_duration=tostring(uptime_duration,"duration")

I want my transactions to ignore the same redondant successif colors.
the result should be something like :
- time_001 Green
- time_003 Red
- time_005 Green
- time_006 Red
- time_007 Green
- time_009 Red

Tags (1)
0 Karma

YoussefB
Engager

Hello,

I already tested : dedup color
But the result is not what i expected.
can you give more informations about dedup filters ?

0 Karma

davebrooking
Contributor

I doubt if this is the most elegant way, it may not even be a correct way (reading the documentation dedup should keep the most recent event) but using reverse prior to the dedup seems to keep the events you want (if time_001 is earlier than time_002).

Try something like
...
| rex ="Host (?.) - (?.)"
| reverse
| dedup color consecutive=t
| sort -_time
| transaction host startswith="Green" endswith="Red*"
| ...

Dave

ahrefai
Engager

try dedup; a filtering command for removing redundunt data that match specific criteria

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...