Search code examples
splunksplunk-query

Splunk: Find the difference between 2 events

I have a server with 2 APIs: /migrate/start and /migrate/end

For each request, I log the userID (field usrid="") of the user using my service to be migrated and the api called (field api="").

Users call /migrate/start, then call /migrate/end. I would like to write a slunk query to list the userIDs that are being migrated, i.e. those that called /migrated/start but have yet to call /migrate/end. How would I write that query?

Thank you

Solution

  • Assuming you have only 2 api calls (start/end) in the logs, you can use a stats command to do this.

    | your_search
| stats values(api) as api by usrid
| where api!="/migrate/end"

    This clubs all api calls done per user and removes the ones which have called /migrate/end