Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: transaction startswith 1, endswith multiple
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all, simple question I hope.
I have a system that has one starting event with multiple outputs and I want to find out how long it takes for the system to produce each output. When I use a transaction, it only seems to give me the combination of the input and just one of the outputs, where I actually need all of the outputs.
transaction activity_id startswith=input_event_name, endswith=output_event_name
Any ideas how I can include all the the outputs? Or is there a much better way to do this?
Many thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How about using stats instead of transaction? Perhaps something like this:
... your search ...
| eval StartTime=if(searchmatch("input_event_name"),_time,null())
| eval EndTime=if(searchmatch("output_event_name"),_time,null())
| stats values(StartTime) as StartTime values(EndTime) as EndTime by activity_id
| mvexpand EndTime
| eval TransactionTime=EndTime - StartTime
This will give you the activity_id, start time, end time, and duration for every instance of output_event_name. If you need to see other information, just modify the stats statement to include it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How about using stats instead of transaction? Perhaps something like this:
... your search ...
| eval StartTime=if(searchmatch("input_event_name"),_time,null())
| eval EndTime=if(searchmatch("output_event_name"),_time,null())
| stats values(StartTime) as StartTime values(EndTime) as EndTime by activity_id
| mvexpand EndTime
| eval TransactionTime=EndTime - StartTime
This will give you the activity_id, start time, end time, and duration for every instance of output_event_name. If you need to see other information, just modify the stats statement to include it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You're very welcome, happy to help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A thousand thank yous wpreston, that worked a treat!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you provide some sample logs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't know how to handle that situation in a transaction, but perhaps this will help.
input_event_name | join activity_id max=0 overwrite=false [ search output_event_name ] | ...
If this reply helps you, Karma would be appreciated.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
