Splunk Search

chaining events together

gregbujak
Path Finder

I am trying to figure out the query that would allow me to chain a series of events together. The issue here is that its an order system where the modification generates a new_id and puts the original id in old_id. old_id will be populated only the first modification message.

This can go on multiple times.

T1 new_id=1, old_id=, ...
T2 new_id=1, old_id=, ...
T3 new_id=2, old_id=1, ...
T4 new_id=2, old_id, ...
T5 new_id=3, old_id=2, ...
T6 new_id=3, old_id=,...
T7 new_id=3, old_id=,...

Modifications happen at T3,T5. Since all these events are technically part of a single conversation, is there a straight forward way to join a possible ENDLESS chain of these together? Any help would help.

I dont believe transaction addresses this particular case.

Tags (2)
0 Karma

3no
Communicator

Hey !

I don't know exactly what you are expecting as output...but I think this should do the job :

index=index sourcetype=sourcetype
| eventstats values(old_id) AS A by new_id
| rename new_id AS B
| eval C=A+","+B
| eval new_id=if(isnull(C),B,C)
| makemv delim="," new_id
| transaction new_id

3no.

0 Karma

_d_
Splunk Employee
Splunk Employee

If old_id exists on the start event, this should do it:

| transaction new_id startswith=(old_id=*)

EDIT: the above, single transaction will isolate only changes. To "chain" those changes together try something like this:

..| eval my_id=if(isnotnull(old_id), "bar" , '') | transaction new_id startswith=(old_id=*) | transaction my_id

0 Karma

_d_
Splunk Employee
Splunk Employee

Ah okay...try the edit above.

0 Karma

gregbujak
Path Finder

All the events in this example are from a single conversation/transaction.

I dont think this accounts for the iterative nature of this type of conversation and the initial messages with null old_id

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The way I understand it, the example in the question is one conversation/transaction. When a new new_id is generated, it's supposed to be chained to the old new_id through the now filled old_id field.

0 Karma

_d_
Splunk Employee
Splunk Employee

That's what the problem statement is, correct? "where the modification generates a new_id and puts the original id in old_id"

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Wouldn't this open a new transaction every time the new_id is changed?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...