Splunk Search

Transaction with uri and referer in apache access

geoff1
New Member

Hi,
I have a Apache access log,for events in every transaction,the referer field of the second event will be the same as uri of the first event, which looks like this:

clientip [timestamp] - - - GET uri1 ... referer1 ...

clientip [timestamp] - - - GET uri2 ... referer2=uri1 ...

clientip [timestamp] - - - GET uri3 ... referer3=uri2 ...

Can I make a transaction based on clientip, uri, referer?

Thanks,
Geoff

0 Karma

kristian_kolb
Ultra Champion

transaction does not work quite that way. The point of specifying more than one field to base the transaction on, is to allow it to span across different types of log, e.g.

  • logs from system_1 contains fieldA=xxx fieldB=yyy
  • logs from system_2 contains fieldB=yyy fieldC=zzz
  • logs from system_3 contains fieldC=zzz fieldD=qqq

Then you can link it together with transaction fieldB fieldC.

In your case you only have a single source of events, but the values on which you want to build your transaction moves between fields. It would be infinitely easier to use a session-id or similar.

/K

0 Karma

geoff1
New Member

Thanks Kolb. Yes I know if the events are in different sourcetypes, it could be eazier to correlate them. But I don't have a session-id in the access log now. Any other commands can get a similiar result as I want?

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...