https://community.splunk.com/t5/Splunk-Search/Get-logs-with-a-distinct-value-of-a-field/m-p/405753#M117294 <P>Hi,</P> <P>Actually dedup TransactionID should work if you are looking for distinct transactions.</P> <P>But if you are looking for all the logs per each transaction, you can try transaction command.</P> <P>index=bc-dag-app AND ERROR | transaction TransactionID</P> <P>Hope, it helps. </P> Thu, 11 Apr 2019 17:33:23 GMT cvssravan 2019-04-11T17:33:23Z https://community.splunk.com/t5/Splunk-Search/Get-logs-with-a-distinct-value-of-a-field/m-p/405752#M117293 <P>I saw some similar questions but none seem to work</P> <P>In my splunk logs, I have this field called <STRONG>TransactionID: 6c5802f0-c317-4d3a-9211-2ed7a10a5d7f -&gt; 46314ef3-dac8-4756-902a-76fc61255d11</STRONG> in my logs<BR /> A <EM>transaction can have multiple errors</EM> but I just want to find how many transactions did error occur in instead of total number of errors.<BR /> In other words, I want logs of distinct TransactionID that has error. </P> <P>I tried <STRONG>index=bc-dag-app AND ERROR | dedup TransactionID</STRONG> but it didn't work.<BR /> Can someone please advise?</P> <P>PS: I am super-new to splunk so I'm sorry if it's a straight forward/stupid question</P> Thu, 11 Apr 2019 16:42:09 GMT https://community.splunk.com/t5/Splunk-Search/Get-logs-with-a-distinct-value-of-a-field/m-p/405752#M117293 ank15july96 2019-04-11T16:42:09Z https://community.splunk.com/t5/Splunk-Search/Get-logs-with-a-distinct-value-of-a-field/m-p/405753#M117294 <P>Hi,</P> <P>Actually dedup TransactionID should work if you are looking for distinct transactions.</P> <P>But if you are looking for all the logs per each transaction, you can try transaction command.</P> <P>index=bc-dag-app AND ERROR | transaction TransactionID</P> <P>Hope, it helps. </P> Thu, 11 Apr 2019 17:33:23 GMT https://community.splunk.com/t5/Splunk-Search/Get-logs-with-a-distinct-value-of-a-field/m-p/405753#M117294 cvssravan 2019-04-11T17:33:23Z https://community.splunk.com/t5/Splunk-Search/Get-logs-with-a-distinct-value-of-a-field/m-p/405754#M117295 <P>I tried the above query but it did not yield any result. <span class="lia-unicode-emoji" title=":confused_face:">😕</span></P> Thu, 11 Apr 2019 20:08:53 GMT https://community.splunk.com/t5/Splunk-Search/Get-logs-with-a-distinct-value-of-a-field/m-p/405754#M117295 ank15july96 2019-04-11T20:08:53Z https://community.splunk.com/t5/Splunk-Search/Get-logs-with-a-distinct-value-of-a-field/m-p/405755#M117296 <P>@ank15july96 First make sure your TransactionID field is being extracted. If it is, then use below query -</P> <PRE><CODE>index=bc-dag-app AND ERROR | stats dc(TransactionID) as error_count </CODE></PRE> Thu, 11 Apr 2019 21:17:01 GMT https://community.splunk.com/t5/Splunk-Search/Get-logs-with-a-distinct-value-of-a-field/m-p/405755#M117296 Vijeta 2019-04-11T21:17:01Z