Transaction to Correlate Events Occuring Close to One Another

[bcarr12]

Apologies if this has already been answered...I can't seem to find a way to get Splunk to correlate events into a single transaction.

Here is an example of the use case:

2014-10-22 11:40:32,596 INFO in.ABC_123 - <43975 MessageInbound LastMkt=MKT LastPx=108.2013 LastNum=123456 Side=1 Symbol=TEST

2014-10-22 11:40:32,900 INFO in.ABC_123 - <43975 MessageInbound LastMkt=MKT LastPx=108.2013 LastNum=123456 Side=2 Symbol=TEST

Both events occur within milliseconds of eachother, so I assume one requirement would be a maxpause=1s in the transaction. The one value that will be different is Side. In general, Side can only be equal to 1 or 2. I need a way to identify any transaction that occurs where LastMkt, LastPx, LastNum, and Symbol are identical in both events, but Side is opposite. I can't use startswith and endswith because it is not a given that Side=1 will always be the starting point (they can be interchanged at any time). I was thinking if there was a way to use an eval within the transaction to indicate that the distinct count of Side was more than 1 maybe?

Ultimately I am trying to create a search that only returns transactions where the above conditions are met and filter out everything else.

Some notes...
These events always occur in pairs of 2 like I posted above, and at most they occur within 1 second of one another.

[martin_mueller · Accepted solution]

You could try this:

base search | transaction maxspan=1s LastMkt LastPx LastNum Symbol

That'll do the grouping on those for to-be-equal fields, and will honour the "within one second" part. However, that won't make sure that exactly two events are grouped together with different Side values. You can filter that out afterwards though:

... | search Side=1 Side=2 eventcount=2

Those two Side=x don't contradict each other because Side is not a multivalue field.

[bcarr12]

This is perfect, thank you! I didn't realize you could run a second search following the transaction to narrow it down, this gives me exactly what I am looking for.