Splunk Search

sequential transactions

marquiselee
Path Finder

Any way to limit transactions to sequential records rather than by time? I have tens of thousands of IDs that can appear many times in a source. Each event of the source has the same _time (the index time of the source).

I'd like to sort the IDs and then transact on ID sequentially so that if the next event matched the ID it would transact on that. However if it did not match the next ID that transaction would be closed.

does this make sense? is this possible?

thanks

Tags (1)
0 Karma

cschmidt0121
Path Finder

You could probably do something crazy like eval _time=ID. Since time is internally just an integer anyway, this probably will work. Of course after you do that the timestamps will be horribly off, but they should at least be ordered as the IDs were.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...