Splunk Search

transaction grouping with startwith and endwith

xinde
Path Finder

log format:

start: A
End: A
start: B
End: B
Start: C
Start: D
End: C
End: D
Start:E
End:F

Query I am using:
| rex field=_raw "END:(?.*)"
| transaction processEndName startswith="Start:" endswith="END:" keeporphans=false keepevicted=false
| sort -duration
| head 10
| stats avg(duration) by processEndName

In the return:
A and B can be group together correctly as:
startA
endA
startB
endB

But C and D are messed up:
startD
endC

also E only has starts, F only has ends, but their process name is different, they got grouped together as well:
startE
endF

Is there a way to properly group C/D and exclude E and F?

Thanks in advance!

0 Karma
1 Solution

mayurr98
SplunkTrust
SplunkTrust

Well, I think you are extracting only END process name, you need to extract START as well. As A,B,C,D,so on is your common values(Process names) which will be in both START and END.
Also, put your code in 101010 sample format so that query will display correctly.

well You query is looking absurd so can not give you correct regex but you can try something like this

(END|START):(?<processname>.*)

let me know if this helps!

View solution in original post

0 Karma

mayurr98
SplunkTrust
SplunkTrust

Well, I think you are extracting only END process name, you need to extract START as well. As A,B,C,D,so on is your common values(Process names) which will be in both START and END.
Also, put your code in 101010 sample format so that query will display correctly.

well You query is looking absurd so can not give you correct regex but you can try something like this

(END|START):(?<processname>.*)

let me know if this helps!

View solution in original post

0 Karma

xinde
Path Finder

Thanks man, it works!

0 Karma

xinde
Path Finder

Not sure why the query did not display correctly
I got processEndName from the following query
| rex field=_raw "END:(?.*)"

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!