Splunk Search

chaining events together

gregbujak
Path Finder

I am trying to figure out the query that would allow me to chain a series of events together. The issue here is that its an order system where the modification generates a new_id and puts the original id in old_id. old_id will be populated only the first modification message.

This can go on multiple times.

T1 new_id=1, old_id=, ...
T2 new_id=1, old_id=, ...
T3 new_id=2, old_id=1, ...
T4 new_id=2, old_id, ...
T5 new_id=3, old_id=2, ...
T6 new_id=3, old_id=,...
T7 new_id=3, old_id=,...

Modifications happen at T3,T5. Since all these events are technically part of a single conversation, is there a straight forward way to join a possible ENDLESS chain of these together? Any help would help.

I dont believe transaction addresses this particular case.

Tags (2)
0 Karma

3no
Communicator

Hey !

I don't know exactly what you are expecting as output...but I think this should do the job :

index=index sourcetype=sourcetype
| eventstats values(old_id) AS A by new_id
| rename new_id AS B
| eval C=A+","+B
| eval new_id=if(isnull(C),B,C)
| makemv delim="," new_id
| transaction new_id

3no.

0 Karma

_d_
Splunk Employee
Splunk Employee

If old_id exists on the start event, this should do it:

| transaction new_id startswith=(old_id=*)

EDIT: the above, single transaction will isolate only changes. To "chain" those changes together try something like this:

..| eval my_id=if(isnotnull(old_id), "bar" , '') | transaction new_id startswith=(old_id=*) | transaction my_id

0 Karma

_d_
Splunk Employee
Splunk Employee

Ah okay...try the edit above.

0 Karma

gregbujak
Path Finder

All the events in this example are from a single conversation/transaction.

I dont think this accounts for the iterative nature of this type of conversation and the initial messages with null old_id

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The way I understand it, the example in the question is one conversation/transaction. When a new new_id is generated, it's supposed to be chained to the old new_id through the now filled old_id field.

0 Karma

_d_
Splunk Employee
Splunk Employee

That's what the problem statement is, correct? "where the modification generates a new_id and puts the original id in old_id"

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Wouldn't this open a new transaction every time the new_id is changed?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...