Splunk Search

Transaction command: How to get the pair up multiple "startswith", but single "endswith" events?

koshyk
Super Champion

hi
We have events something like below

2019-04-30 11:00:01 page=Login.jsp action=login  userid=1234 comment="User opened a session"
2019-04-30 11:01:01 page=Login.jsp action=login  userid=1234 comment="User might have opened another session"
2019-04-30 11:02:01 page=Logout.jsp action=logout userid=1234 comment="User logged out session"

But when user "logsout", that means he has completely logged out of all sessions

When I do a

...
| transaction userid startswith=(action="login") endswith=(action="logout") maxspan=1h keepevicted=true

I was looking for output as a Single Transaction, but currently it comes up as "TWO" txn events; as it pairs the closest/nearby events ONLY

# Transaction Output1
2019-04-30 11:01:01 page=Login.jsp action=login  userid=1234 comment="User might have opened another session"
2019-04-30 11:02:01 page=Logout.jsp action=logout userid=1234 comment="User logged out session"

# Transaction Output2
2019-04-30 11:00:01 page=Login.jsp action=login  userid=1234 comment="User opened a session"

Any options to make it as "SINGLE" output? as the user have logged out of system, so pairing with above conditions should pair both "logins" to a single logout

I was looking for OUPUT like below

# Single Transaction Output
2019-04-30 11:00:01 page=Login.jsp action=login  userid=1234 comment="User opened a session"
2019-04-30 11:01:01 page=Login.jsp action=login  userid=1234 comment="User might have opened another session"
2019-04-30 11:02:01 page=Logout.jsp action=logout userid=1234 comment="User logged out session"
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...