https://community.splunk.com/t5/Splunk-Search/How-to-make-this-transaction-work-and-find-values-from-one/m-p/375928#M110432 <P>I am trying to correlate two resultsets.<BR /><BR /> One is a straight search of apache logs.<BR /> The other is a table that that took a long time to run (several days)</P> <P>I wanted to know if the web logs are likely related the results in the table, which I define by them happening around the same time. So I tried using the transaction command with a dummy common value</P> <PRE><CODE>|searchA | eval dummy="true", from="searchA" | append [|loadjob sid=job2 | eval dummy="true", from="searchB"] | transaction dummy maxspan=3s </CODE></PRE> <P>And this does create a resultset of transactions, but it ignored the appended loadjob. I think this was because that job's results were a table, not events. So I tried turning it into events </P> <PRE><CODE>|loadjob sid=job2 | eval dummy="true", from="searchB" | eval _raw=_time." ".col1." ".col2 </CODE></PRE> <P>And then used that for the transaction</P> <PRE><CODE>|searchA | eval dummy="true", from="searchA" | append [|loadjob sid=job2 | eval dummy="true", from="searchB" | eval _raw=_time." ".col1." ".col2] | transaction dummy maxspan=3s </CODE></PRE> <P>But this creates distinct transactions for each "from" value even though I only defined the transaction field on "dummy". </P> <P>Does anyone have a suggestion on how I can correlate these two result sets on time?<BR /> My ultimate goal will be to finish the query with </P> <PRE><CODE>|search from="searchA" from="searchB" </CODE></PRE> <P>So I can find values from one result set that might be related to the other</P> Mon, 07 May 2018 16:42:47 GMT MonkeyK 2018-05-07T16:42:47Z https://community.splunk.com/t5/Splunk-Search/How-to-make-this-transaction-work-and-find-values-from-one/m-p/375928#M110432 <P>I am trying to correlate two resultsets.<BR /><BR /> One is a straight search of apache logs.<BR /> The other is a table that that took a long time to run (several days)</P> <P>I wanted to know if the web logs are likely related the results in the table, which I define by them happening around the same time. So I tried using the transaction command with a dummy common value</P> <PRE><CODE>|searchA | eval dummy="true", from="searchA" | append [|loadjob sid=job2 | eval dummy="true", from="searchB"] | transaction dummy maxspan=3s </CODE></PRE> <P>And this does create a resultset of transactions, but it ignored the appended loadjob. I think this was because that job's results were a table, not events. So I tried turning it into events </P> <PRE><CODE>|loadjob sid=job2 | eval dummy="true", from="searchB" | eval _raw=_time." ".col1." ".col2 </CODE></PRE> <P>And then used that for the transaction</P> <PRE><CODE>|searchA | eval dummy="true", from="searchA" | append [|loadjob sid=job2 | eval dummy="true", from="searchB" | eval _raw=_time." ".col1." ".col2] | transaction dummy maxspan=3s </CODE></PRE> <P>But this creates distinct transactions for each "from" value even though I only defined the transaction field on "dummy". </P> <P>Does anyone have a suggestion on how I can correlate these two result sets on time?<BR /> My ultimate goal will be to finish the query with </P> <PRE><CODE>|search from="searchA" from="searchB" </CODE></PRE> <P>So I can find values from one result set that might be related to the other</P> Mon, 07 May 2018 16:42:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-this-transaction-work-and-find-values-from-one/m-p/375928#M110432 MonkeyK 2018-05-07T16:42:47Z