Unfortunately, this didn't work for me. Still, no idea why those events are not found ... View more

@richgalloway I have another query:   event_status="delivered" OR event_status="in_transit" | transaction tracking_number startswith=event_status=delivered endswith=event_status=in_transit keepevicted=true | where duration > 3600 | search closed_txn=1   Which returned 5 transactions fit for this condition for the last 2 weeks. Here's one of those(accidentally fits my final requirement):   {"timestamp":"2023-07-06T23:44:52.784Z","tracking_number":"C11900891311111","event_status":"delivered","event_time":"2023-07-06T23:44:38.722Z"} {"timestamp":"2023-07-07T07:03:10.712Z","tracking_number":"C11900891311111","event_status":"in_transit","event_time":"2023-07-03T18:24:36.668Z"}   If we take a look at event_time field of the delivered event and assume that it will replace _time field for it, then after comparison of two timestamps in_transit event clearly came 8 hours after the first one.  For some reason, these 5 transactions are not included in the total calculations in the query that you helped me to compose:   event_status="delivered" OR event_status="in_transit" | eval _time=if(event_status="delivered", strptime(event_time, "%Y-%m-%dT%H:%M:%S.%3N%Z"), _time) | sort - _time | transaction tracking_number startswith=event_status=delivered endswith=event_status=in_transit keepevicted=true | where duration > 3600 | stats sum(eventcount) as eventcount by closed_txn | eventstats sum(eventcount) as totalcount | where closed_txn == 1``` remaining eventcount only includes complete transactions ``` | eval percentage = eventcount * 100 / totalcount    The strange thing is - I tried singling this transaction this way:   event_status="delivered" OR event_status="in_transit" AND "C11900891311111" | eval _time=if(event_status="delivered", strptime(event_time, "%Y-%m-%dT%H:%M:%S.%3N%Z"), _time) | sort - _time | transaction tracking_number startswith=event_status=delivered endswith=event_status=in_transit keepevicted=true | where duration > 3600 | stats sum(eventcount) as eventcount by closed_txn   And successfully found it! But removing condition AND "C11900891311111" at the start of the query gives me 0 results. This is very strange, right? P.S. Sorry for my continuous inquiries, I just really want to get to the root of the problem. I will upvote your answers as well! ... View more

Good solution! I didn't even know we could intervene in the fields to this extent. But this solution didn't work for me. Splunk gives Error in 'transaction' command: This search requires events to be in descending time order, but the preceding search does not guarantee time-ordered events.  I don't really understand the problem, if the conditions are not met, then why not ignore this transaction in the final calculation? Probably has something to do with transaction conditions startswith and endswith. But I'm not sure. Do you happen to know a solution? ... View more

I also have a question related to the time frames, for the query you provided earlier | transaction tracking_number startswith=shipment_status=in_transit endswith=shipment_status=delivered keepevicted=true | stats sum(eventcount) as eventcount by closed_txn | eventstats sum(eventcount) as totalcount | where closed_txn == 1``` remaining eventcount only includes complete transactions ``` | eval percentage = eventcount * 100 / totalcount Is it possible to add a clause, that only transactions, for which events span more than 1 hour between them, could be included in the eventcount ? using the _time field for example?  Transaction's maxspan and maxpause do not suit these calculations, and I couldn't write something using mvindex or strptime to make it work. For example,  in_transit event was received at 7/3/23 9:07:00.000 AM and delivered events came after that at 7/3/23 11:10:00.000 AM, in this case, this transaction should be considered as completed and counted to eventcount. I would be very grateful for your help! ... View more

Thanks a lot, you really just saved me! I haven't even watched on the transaction command side, tried to do it just by eval and eventstats commands. ... View more