Splunk Search

Transaction with multiple startswith conditions

dbcase
Motivator

Hi,

I'm looking to get a duration for a transaction that has multiple startswith conditions they are

BUFFERING
CONNECTED
CONNECTING
PREPARED
RECONNECTING
STREAMING

There is only 1 endswith condition

STOPPED

The data looks like this

{ [-]
Properties: { [-]
args: [ [-]
BUFFERING

]

category: Event

index: 2

}

analyticType: DynamicChoice

buildTarget: fred

clientSessionId: DXDYVVP-ACERSJC

Any thoughts?

0 Karma
1 Solution

elliotproebstel
Champion

Here's an approach, assuming those values are stored in a field called condition_field:

your search 
| eval transaction_start=if(in(condition_field, "BUFFERING", "CONNECTED", "CONNECTING", "PREPARED", "RECONNECTING", "STREAMING"), _time, NULL), transaction_end=if(like(condition_field, "STOPPED"), _time, NULL) 
| stats earliest(transaction_start) AS start_time latest(transaction_end) AS end_time BY clientSessionId 
| eval duration=tostring((end_time-start_time), "duration")

View solution in original post

elliotproebstel
Champion

Here's an approach, assuming those values are stored in a field called condition_field:

your search 
| eval transaction_start=if(in(condition_field, "BUFFERING", "CONNECTED", "CONNECTING", "PREPARED", "RECONNECTING", "STREAMING"), _time, NULL), transaction_end=if(like(condition_field, "STOPPED"), _time, NULL) 
| stats earliest(transaction_start) AS start_time latest(transaction_end) AS end_time BY clientSessionId 
| eval duration=tostring((end_time-start_time), "duration")

dbcase
Motivator

Hi Elliotproebstel,

I could never seem to get this to work. Kept complaining about missing quotes (found that) and a missing ending ")" that I could never seem to find

0 Karma

elliotproebstel
Champion

Sorry for the missing quotation mark. Fixing that now in the OP. But as for the missing ) <- any chance that's somewhere in the data? Here's some run-anywhere code that creates two events and finds the duration of time between them, as an example:

| makeresults 
| eval condition_field="BUFFERING", clientSessionId=1234 
| append 
[| makeresults 
| eval condition_field="STOPPED", _time=_time+100, clientSessionId=1234]
| eval transaction_start=if(in(condition_field, "BUFFERING", "CONNECTED", "CONNECTING", "PREPARED", "RECONNECTING", "STREAMING"), _time, NULL), transaction_end=if(like(condition_field, "STOPPED"), _time, NULL) 
| stats earliest(transaction_start) AS start_time latest(transaction_end) AS end_time BY clientSessionId  
| eval duration=tostring((end_time-start_time), "duration")
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...