https://community.splunk.com/t5/Splunk-Search/Convert-Transaction-Search/m-p/427549#M122416 <P>I made the following search to group exceptions together that happened within 1 second but I want to be able to view the source and make the search more efficient. Is there a search that will yield the same results without using the transaction command?</P> <P>index=java_logs Exception | transaction maxspan=1s</P> Mon, 05 Aug 2019 13:55:15 GMT bah5663_98 2019-08-05T13:55:15Z https://community.splunk.com/t5/Splunk-Search/Convert-Transaction-Search/m-p/427549#M122416 <P>I made the following search to group exceptions together that happened within 1 second but I want to be able to view the source and make the search more efficient. Is there a search that will yield the same results without using the transaction command?</P> <P>index=java_logs Exception | transaction maxspan=1s</P> Mon, 05 Aug 2019 13:55:15 GMT https://community.splunk.com/t5/Splunk-Search/Convert-Transaction-Search/m-p/427549#M122416 bah5663_98 2019-08-05T13:55:15Z https://community.splunk.com/t5/Splunk-Search/Convert-Transaction-Search/m-p/427550#M122417 <P>Try <CODE>index=java_logs Exception | bin span=1s _time | stats values(*) as * by _time</CODE></P> Mon, 05 Aug 2019 15:45:41 GMT https://community.splunk.com/t5/Splunk-Search/Convert-Transaction-Search/m-p/427550#M122417 richgalloway 2019-08-05T15:45:41Z https://community.splunk.com/t5/Splunk-Search/Convert-Transaction-Search/m-p/427551#M122418 <P>Yes, try this:</P> <PRE><CODE>index=java_logs Exception | bin _time span=1s | stats list(_raw) AS events values(source) AS sources BY _time </CODE></PRE> Mon, 05 Aug 2019 16:26:43 GMT https://community.splunk.com/t5/Splunk-Search/Convert-Transaction-Search/m-p/427551#M122418 woodcock 2019-08-05T16:26:43Z