Splunk Search

Transaction not using time ordered events

Explorer

Hi,

I am trying to order events of wireshark data i.e. events like

time1  src, dst,src_port,dst_port  SYN  

 time2 src, dst,src_port,dst_port  FIN 

 

time3  src, dst,src_port,dst_port  SYN  

 time4 src, dst,src_port,dst_port  FIN 

 

but transaction creates a transaction  out of the time2 and time  event. which do not belong together despite using startwith and endwith.

I used the following 

eval sdspdp=src+":"+dst+":"+src_port+":"+dst_port
| transaction sdspdp startswith="SYN" endswith="FIN" keepevicted=true unifyends=true | where closed_txn=1 | table time packet_info closed_txn

And I would expect the SYN before the HELLO and FIN, but it isn't.  Why ? 

time packet_info closed_txn

 
 
 
 
2020-10-22 18:51:42.772567
2020-10-22 18:51:42.791144
2020-10-22 18:51:42.933482
50020 → 8089 [FIN, ACK] Seq=930 Ack=119936 Win=81408 Len=0 TSval=2422219150 TSecr=1505344044
50020 → 8089 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=2422219110 TSecr=0 WS=128
Client Hello
1
2020-10-22 18:51:42.464082
2020-10-22 18:51:42.492535
2020-10-22 18:51:42.602374
54728 → http-alt(8080) [FIN, ACK] Seq=896 Ack=32983 Win=42368 Len=0 TSval=2422219067 TSecr=2891895242
54728 → http-alt(8080) [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=2422219032 TSecr=0 WS=128
Client Hello
1

 

 

Thank you

Markus

Labels (1)
0 Karma

SplunkTrust
SplunkTrust

sample:

 

index=_internal | head 10 | streamstats count | eval _raw=count, flag="A"
| transaction flag

 


before transaction, try | reverse

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!