topic How can we access perfect json events after applying the transaction command? in Getting Data In

How can we access perfect json events after applying the transaction command?

ddrillic — Fri, 09 Feb 2018 20:53:44 GMT

With lots of help here, we adjusted the incoming data to be perfect json structures and name value pairs are extracted nicely now that each json document is mapped to one Splunk event.

We would like know to proceed and use the transaction command. But by applying the transaction command, we'll lose the perfect json structure, right?

What can be done?

Re: How can we access perfect json events after applying the transaction command?

elliotproebstel — Fri, 09 Feb 2018 22:08:10 GMT

When you use transaction, that will create multi-value fields out of fields that exist in multiple events that are being combined. But that's always true when you use transaction, so it's really no different than using it with events of other structures. Or am I missing what you're saying here?

Re: How can we access perfect json events after applying the transaction command?

micahkemp — Sat, 10 Feb 2018 02:54:27 GMT

My question would be, "what do you want to do with the JSON structures after you've run transaction? Could you accomplish what you need without transaction (often possible, but not always)? And perhaps do you really need the JSON structures of individual events at the end of all of that?