Splunk Search

sequential transactions

marquiselee
Path Finder

Any way to limit transactions to sequential records rather than by time? I have tens of thousands of IDs that can appear many times in a source. Each event of the source has the same _time (the index time of the source).

I'd like to sort the IDs and then transact on ID sequentially so that if the next event matched the ID it would transact on that. However if it did not match the next ID that transaction would be closed.

does this make sense? is this possible?

thanks

Tags (1)
0 Karma

cschmidt0121
Path Finder

You could probably do something crazy like eval _time=ID. Since time is internally just an integer anyway, this probably will work. Of course after you do that the timestamps will be horribly off, but they should at least be ordered as the IDs were.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...