8/25/2023 0 Comments Splunk transaction same event![]() It is still limited by the maximum size of the subsearch, but at least provides the necessary data. This is faster than using a map with multiple subsearches, and gives all the of results. | eval zipped=mvzip(mvzip(first2, last2, ","), date, ",") | search first1!=null last1!=null first2!=null last2!=null | stats list(first1) as first1, list(last1) as last1, list(first2) as first2, list(last2) as last2, list(date) as date by matchId | rename referrer_id as matchId, first_name as first2, last_name as last2 | rename id as matchId, first_name as first1, last_name as last1 Splunk doesn't offer a multifield mv expand, so I used a workaround. It also gave extra empty fields, so I had to remove those, and then manipulate the resulting mv's into their own individual rows. Using append returned a full list, and using stats by id gave me the result I was looking for, a full list of each matching pair. Using join gave me faster results, but didn't result in every matching pair, for my example it would return 2 rows instead of three, returning Adam with Betty, but not returning Adam with Carol. Surely there must exist a simpler, faster way that this can be done, which isn't limited by the arbitrary limited settings or the multiple repeating search queries. This seems like an overly complicated solution, especially in comparison to the sql query. The above query works for me and gives me the table I need, but it is incredibly slow due to the repeated searches over the entire time frame, and also limited by the map maxsearches which, for whatever reason, cannot be set to unlimited. As a result, I get one transaction instead of two, with the start from the first collection and the end from the second collection. Values(last2) as last2, values(time) as time by id 'transaction ConsoleId LogonId Item startswithLS-XUBF endswithLS-XUCF' sounds like exactly what I want, but it appears to not let the start event and end event have the same timestamp. | stats values(first1) as first1, values(last1) as last1, values(first2) as first2, | fields first1, last1, first2, last2, match_id, time | fields first_name, last_name, referral_id, date I did attempt to use appendcols but that didn't return anything for me. Then, since append creates a new row instead of appending to the same row, using a stats to aggregate the resulting rows by the matching id field. Next, I attempted to use a subsearch, first finding the id and then searching in the subsearch, first for the first event by id and the appending the second event by referral_id. First I attempted to use the transaction command, but that aggregated all of the related events together as opposed to matching them a pair at a time. Now, I've been attempting to replicate this in a splunk query and have run into quite a few issues. Inner join myTable b on a.id = b.referrer_id select a.first_name as first1, a.last_name as last1, b.first_name as first2, In sql I can do this quite easily with the following command. Betty Burger referred Darren Dougan on 08:00:00.000. ![]() Adam Anderson referred Carol Camp on 08:00:00.000.Adam Anderson referred Betty Burger on 08:00:00.000.I need to return a pair of events where field id from event1, matches field referrer_id from event2. I have a data source in which I need to return all pairs of events (event1, event2) from a single data source, where field1 from event1 matches field2 from event2.įor example, let's say I have the following data.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |