https://community.splunk.com/t5/Splunk-Dev/Group-events-within-a-transaction/m-p/56835#M749 <P>Can you group events within a transaction? </P> <P>Suppose that there are two types of events: "down" and "link" and sometimes there are multiple reports/events correponding to one unique "link" event (suppose link events happend within 10s refers to one event)</P> <P>The following groups all the "link" events in between "down" in one transaction. </P> <P>"link" or "down" | transaction endswith="down" </P> <P>However, I cannnot further use transaction to group link events happening within 10s apart. Is there any search phrase that allows you to calculate the number of <EM>unique</EM> "link" events in between "down" events? </P> Thu, 10 Mar 2011 10:09:02 GMT myli12 2011-03-10T10:09:02Z https://community.splunk.com/t5/Splunk-Dev/Group-events-within-a-transaction/m-p/56835#M749 <P>Can you group events within a transaction? </P> <P>Suppose that there are two types of events: "down" and "link" and sometimes there are multiple reports/events correponding to one unique "link" event (suppose link events happend within 10s refers to one event)</P> <P>The following groups all the "link" events in between "down" in one transaction. </P> <P>"link" or "down" | transaction endswith="down" </P> <P>However, I cannnot further use transaction to group link events happening within 10s apart. Is there any search phrase that allows you to calculate the number of <EM>unique</EM> "link" events in between "down" events? </P> Thu, 10 Mar 2011 10:09:02 GMT https://community.splunk.com/t5/Splunk-Dev/Group-events-within-a-transaction/m-p/56835#M749 myli12 2011-03-10T10:09:02Z https://community.splunk.com/t5/Splunk-Dev/Group-events-within-a-transaction/m-p/56836#M750 <P>Can you clarify your question, perhaps with an example set of data?</P> <P>Transaction does add a linecount property, which you might be able to use to determine the number of unique link events, possibly in conjunction with the dedup operator.</P> Thu, 17 Mar 2011 21:32:57 GMT https://community.splunk.com/t5/Splunk-Dev/Group-events-within-a-transaction/m-p/56836#M750 dart 2011-03-17T21:32:57Z