Splunk Search

how to use transaction to Group multiple events with field values in a specific order

New Member

hello , i have many logs like:

"_time1 user=A eventid =45"

"_time2 user=A eventid=46"

"_time3 user=A eventid=48"

"_time4 user=B eventid=45"

"_time5 user=A eventid=46"

i want to transaction new event like:

"_time1 user=A eventid=45

_time2 user=A eventid=46

_time3 user=A eventid=48"

Labels (1)
Tags (2)
0 Karma

Ultra Champion

 what is the conditions?

0 Karma

New Member

hello

conditions are:

if user=A, and The eventid values of the three events are 45, 46 and 48 in sequence,then group this three event。

0 Karma

Ultra Champion
index=_internal 
| head 5 
| fields _time _raw 
| reverse 
| streamstats count 
| eval _raw="user=".if(count=4,"B","A")." eventid=".mvindex(split("45.46.48.45.46","."),count - 1)
| fields - count
| kv 
| rename COMMENT as "this is sample" 
| transaction user maxevents=3

see the command reference.

0 Karma

New Member

Thankyou for your help. i try your sample case . but it does not meet my request. In my request, 45, 46, and 48 must appear strictly in this order . I have added some content based on yours.  pls help me .

 

index=_internal
| head 10
| fields _time _raw
| reverse
| streamstats count
| eval _raw="user=".if(count=8,"B","A")." eventid=".mvindex(split("45.46.48.45.48.48.46.48.45.46","."),count -1 )
| fields -count
| kv
| rename COMMENT as "this is sample"
| transaction user maxevents=3

qiuxiaoping_0-1596678566260.png

 

 

 

0 Karma

New Member

hello

conditions are:

if user=A, and The eventid values of the three events are 45, 46 and 48 in sequence,then group this three event。

0 Karma