Transaction command not working

shashank_24 — Thu, 09 Jul 2020 12:09:28 GMT

Hi, I am trying to use transaction command where I need to get the data from 2 specific events with different sourcetypes. These 2 events are

2020-07-09 12:50:09,918 id="id:1234" event=test_attempt app= connid=myapp status=inprogress responsetime=7 inmessagetype="Request" 2020-07-09 12:50:09,105 id:1234 INFO [org.test.validator.MediaValidator] in MediaValidator VERIFIED user=test@gmail.com found and match

The 1st event could occur multiple times in the same transaction and that's why sometimes my transaction command is just grouping those 2 events and that's it.
The common attribute in both of these events are id on which I am using transaction like below but it doesn't seem to be working.

Sometimes I am only getting single event and sometimes the 1st event is grouped together

Can someone advice what could be done here to achieve this task. I can't use join because of the subsearch limitation and I have to use the transaction.

index=myindex (sourcetype="server_log" "[org.test.validator.MediaValidator] in MediaValidator) OR (source="/app/log/splunk-audit.log" event=test_attempt inmessagetype="Request" sourcetype=audit_log) | rex field=_raw "id\=\"id\:(?<id>[^\"]+)" | rex field=_raw "id\:(?<id>[^\s]+)" | transaction id keepevicted=true

@gcusello @to4kawa

Re: Transaction command not working

richgalloway — Thu, 09 Jul 2020 12:30:37 GMT

Instead of transaction, try stats

| stats values(*) as * by id

Re: Transaction command not working

shashank_24 — Tue, 14 Jul 2020 08:58:30 GMT

@richgalloway Thanks for the response. I knew this solution with stats but I was trying to understand why transaction is not working. Anyways I was able to achieve with stats so i will accept the answer.

topic Transaction command not working in Splunk Enterprise

Transaction command not working

Re: Transaction command not working

Re: Transaction command not working