Transaction works in small time window

[hartfoml]

I am trying to develop a way to track down time by evaluating the windows event logs.

Condition – Someone has requested a reboot of the server
I know when this happens an event is recorded with “EventCode=1074”
When the system comes online it registers a “EventCode=35”

If I use this search

‘host=xyz sourcetype="WinEventLog:System" (SourceName=USER32 EventCode=1074) OR (SourceName=W32Time EventCode=35)’

I can see the stop command issued to the system as well as the time the "time service" on the system started. This gives me a starting point to know how long the system was down.

I tried this search to get duration number in seconds using the transaction command

‘host=xyz sourcetype="WinEventLog:System" | transaction startswith=(SourceName=USER32 EventCode=1074) endswith=(SourceName=W32Time EventCode=35)’

I get the right duration but only if I am dialed in on the right time frame. If I choose too large a time window the search returns no values.

Can anyone tell me why my transaction code works in a small time window but not in a large time window???

[Lamar · Accepted solution]

Personally, I would do something like this:

host=xyz sourcetype="WinEventLog:System" (SourceName=USER32 AND Eventcode=1074) OR (SourceName=W32Time AND EventCode=35) | transaction maxspan=10m maxpause=5m keepevicted=0 startswith="EventCode=1074" endswith="EventCode=35"

What this does for you is it applies some constraints to your transaction processing. Meaning the transaction command will not look for instances where the total time between the shutdown and startup should never exceed 5 minutes (maxpause). Additionally, the transaction command will not look out past 10 minutes for matching pairs (maxspan). Obviously, you can play with the settings a bit to get what you really want.

Lastly, the keepevicted set to false basically throws any results you have, that don't match what you're look for, on the floor so they don't corrupt your statistics.

Now, you should be able to simply choose your time picker for the last day, last 4 hours etc...and get the results you're looking for...

Hope that helps.

[hartfoml]

Thanks this was the answer it didn't work at first but i noticed after some time that the first Eventcode= was not cap's on the "C" (EventCode) so it returned no records. When i corrected it it worked and man did it work great. thanks for the help