Splunk Search

capture specific sequence of events

michaelrosello
Path Finder

I have these set of event based on transaction But I only want to compute a specific sequence of events and discard the rest.

Here is the criteria for the sequence of what I want to capture.

  1. should start with pageDefault
  2. followed by 1 or 2 occurence of pageChange
  3. followed by 3 or 4 occurrence of listRead

alt text

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi michaelrosello,
filter events before and after transaction, something like this:

index=my_index (page=pageDefault OR page=pageChange OR page=listRead)
| transaction startswith="pageDefault "
| search page=pageChange page=listRead
| table _time url page response_time

Bye.
Giuseppe

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Do you want to go from one pageDefault to the next pageDefault, but only those ending with listRead? And that would mean that the first four pageDefault entries would be thrown out. Or do you want to go from the first pageDefault through to at least the last in the set of listRead entries? That will make a big difference.

0 Karma

michaelrosello
Path Finder

There should only be one set of events that I should capture. So based on my screenshot. the sequence of pageDefault,pageChange,pageChange,listRead,listRead,listRead will be computed and the rest thrown out.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...