Splunk Search

Why is my transaction search counting events that are not immediately after each other?

christopheryu
Communicator

I am having an issue with search using transaction starts/endswith. The information I am pulling counts transactions that are not immediately after each other or in sequence.

search | transaction startswith="LSP_DOWN" endswith="LSP_UP" | eval DownTime=_time  | eval UpTime=_time+duration | eval DownTime=strftime(DownTime, "%D:%H:%M:%S") | eval UpTime=strftime(UpTime, "%D:%H:%M:%S") | eval duration=tostring(duration, "duration")  | table LSP DownTime UpTime duration

Sample result shown below for one LSP (out of >10k LSPs), where the second line shouldn't be counted as a completed transaction:

LSPA  07/19/16:16:54:22  07/19/16:16:54:28  00:00:06  
LSPA  07/10/16:05:08:48  07/31/16:06:03:48  21+00:55:00  
LSPA  07/09/16:04:46:11  07/09/16:04:46:19  00:00:08  

Sequence of events:

07/31/16:06:03:48 LSP UP
07/19/16:16:54:28 LSP UP
07/19/16:16:54:22 LSP DOWN
07/10/16:05:08:48 LSP DOWN
07/09/16:04:46:19 LSP UP
07/09/16:04:46:11 LSP DOWN

Based on the above, the result should discard 07/31/16:06:03:48 LSP UP & 07/10/16:05:08:48 LSP DOWN as they are incomplete events. maxopenevents=2 or maxopentxn=2 fixes the issue, however, they remove a lot of other valid "complete" transactions.

rgcox1
Communicator

See Descending time order required
Strangely, I've also found that evals after the transaction can scramble the results.

0 Karma

christopheryu
Communicator

Still looking for an answer...

0 Karma

svenwendler
Path Finder

Try adding unifyends= true to your transaction command.

0 Karma

christopheryu
Communicator

I've tried each with unifyends=true, maxevents=2, maxopentxn=2, maxopenevents=2 and also combinations of them.

0 Karma

sundareshr
Legend

I would suggest one of these options...

... | transaction startswith="LSP_DOWN" endswith="LSP_UP" maxevents=2 | ...

OR

.... | rex "(?<state>UP|DOWN)" | autoregress state as next_state | where state!=nextstate | delta _time as duration | where state="DOWN" | eval DownTime=_time  | eval UpTime=_time+duration | eval DownTime=strftime(DownTime, "%D:%H:%M:%S") | eval UpTime=strftime(UpTime, "%D:%H:%M:%S") | eval duration=tostring(duration, "duration")  | table LSP DownTime UpTime duration
0 Karma

christopheryu
Communicator

Thank you for the response, the maxevents=2 suggestion produced the same result as not having it there.

The second suggestion produced the same result except that it switches the DownTime with UpTime starting from the second line and only computed the duration of the first line, the others showed with no duration value.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...