Transactions with conditional Endswidth or differe...

Splunk Search

I have a series of events that always start with EventTypeName = "Node Down" but there are three scenarios I'm trying to capture.

1. "Node Down" --> "Node Up"

2. "Node Down" --> "Node Rebooted" ---> "Node Up"

3. "Node Down" --> "Node Up" --> "Node Rebooted"

Is there a way to capture all three of these scenarios? I'm trying to categorize transactions based on whether or not a Node Rebooted event is present in the transaction or not present.

I tried using OR with endswith but it only matches the first event.

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...