Splunk Search

"transaction" command: have four "startswith" and two "endswith" patterns for the same transaction

sp
Loves-to-Learn

I need to run a Splunk search with "transaction" command and I have four pattern variations for the start of the transaction and two pattern variations for the end of that transaction.

I read the documentation and experimented but still not sure how exactly I should do this. I am operating on complex extensive data so it's not immediately clear whether I am doing this correctly and I need to get it right. I tried the following:

1. Wildcards in startswith and endswith: "endswith=...*..."

2. The syntax "endswith=... OR endswith=...".     -- same for startswith

3. The syntax "endswith=... OR ...".

4. Regular expressions instead of wildcards: .* instead of *

Could you suggest the right way of doing this?

Thank you!

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sp ,

as @bowesmana said, transaction command should be avoided all times that's possible.

probably the only condition when it could be used is when you have to use startswith or endswith conditions.

Anyway, you can use the OR condition:

| transaction startswith=("string1" OR "string2" OR "string3" OR "string4") endswith=("string5" OR "string6")

Ciao.

Giuseppe

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I would suggest looking at ways of NOT using transaction, as it has limitations. stats can often solve the problem of transaction.

Perhaps you can give an example of your data and say what you are trying to achieve - then the right solution may be clearer.

You can use eval statements in starts and endswith, but before you go down that route, let's see what you're trying to get to

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...