Splunk Search

transaction startswith 1, endswith multiple

leea11
Engager

Hi all, simple question I hope.
I have a system that has one starting event with multiple outputs and I want to find out how long it takes for the system to produce each output. When I use a transaction, it only seems to give me the combination of the input and just one of the outputs, where I actually need all of the outputs.

transaction  activity_id startswith=input_event_name, endswith=output_event_name

Any ideas how I can include all the the outputs? Or is there a much better way to do this?

Many thanks

Tags (1)
0 Karma
1 Solution

wpreston
Motivator

How about using stats instead of transaction? Perhaps something like this:

... your search ... 
| eval StartTime=if(searchmatch("input_event_name"),_time,null()) 
| eval EndTime=if(searchmatch("output_event_name"),_time,null()) 
| stats values(StartTime) as StartTime values(EndTime) as EndTime by activity_id
| mvexpand EndTime
| eval TransactionTime=EndTime - StartTime 

This will give you the activity_id, start time, end time, and duration for every instance of output_event_name. If you need to see other information, just modify the stats statement to include it.

View solution in original post

wpreston
Motivator

How about using stats instead of transaction? Perhaps something like this:

... your search ... 
| eval StartTime=if(searchmatch("input_event_name"),_time,null()) 
| eval EndTime=if(searchmatch("output_event_name"),_time,null()) 
| stats values(StartTime) as StartTime values(EndTime) as EndTime by activity_id
| mvexpand EndTime
| eval TransactionTime=EndTime - StartTime 

This will give you the activity_id, start time, end time, and duration for every instance of output_event_name. If you need to see other information, just modify the stats statement to include it.

wpreston
Motivator

You're very welcome, happy to help!

0 Karma

leea11
Engager

A thousand thank yous wpreston, that worked a treat!

0 Karma

somesoni2
Revered Legend

Can you provide some sample logs?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't know how to handle that situation in a transaction, but perhaps this will help.

input_event_name | join activity_id max=0 overwrite=false [ search output_event_name ] | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...