Splunk Search

capture specific sequence of events

michaelrosello
Path Finder

I have these set of event based on transaction But I only want to compute a specific sequence of events and discard the rest.

Here is the criteria for the sequence of what I want to capture.

  1. should start with pageDefault
  2. followed by 1 or 2 occurence of pageChange
  3. followed by 3 or 4 occurrence of listRead

alt text

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi michaelrosello,
filter events before and after transaction, something like this:

index=my_index (page=pageDefault OR page=pageChange OR page=listRead)
| transaction startswith="pageDefault "
| search page=pageChange page=listRead
| table _time url page response_time

Bye.
Giuseppe

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Do you want to go from one pageDefault to the next pageDefault, but only those ending with listRead? And that would mean that the first four pageDefault entries would be thrown out. Or do you want to go from the first pageDefault through to at least the last in the set of listRead entries? That will make a big difference.

0 Karma

michaelrosello
Path Finder

There should only be one set of events that I should capture. So based on my screenshot. the sequence of pageDefault,pageChange,pageChange,listRead,listRead,listRead will be computed and the rest thrown out.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...