https://community.splunk.com/t5/Splunk-Search/Is-using-the-transaction-command-an-overkill-in-this-case/m-p/438170#M124732 <P>If I have two searches as below (uniqueId is a common field exists in both searches, while field1, field2 are unique fields only applying to it search)</P> <PRE><CODE>EVENT_CONTAIN_SOME_KEYWORD | table uniqueId, field1 EVENT_CONTAIN_ANOTHER_KEYWORD | table uniqueId, field2 </CODE></PRE> <P>Then i can use the transaction command to combine the table (it is safe to assume there are only one field1 and one field2 for every uniqueId)</P> <PRE><CODE>EVENT_CONTAIN_SOME_KEYWORD OR EVENT_CONTAIN_ANOTHER_KEYWORD | transaction uniqueId | table uniqueId, field1, field2 </CODE></PRE> <P>I am not using any of those startswith / endswith / maxspan / maxpause args really.<BR /> Is there a way to avoid using transaction, and make my query more efficient?</P> <P>Thanks!</P> Mon, 17 Dec 2018 14:37:17 GMT jliu531 2018-12-17T14:37:17Z https://community.splunk.com/t5/Splunk-Search/Is-using-the-transaction-command-an-overkill-in-this-case/m-p/438170#M124732 <P>If I have two searches as below (uniqueId is a common field exists in both searches, while field1, field2 are unique fields only applying to it search)</P> <PRE><CODE>EVENT_CONTAIN_SOME_KEYWORD | table uniqueId, field1 EVENT_CONTAIN_ANOTHER_KEYWORD | table uniqueId, field2 </CODE></PRE> <P>Then i can use the transaction command to combine the table (it is safe to assume there are only one field1 and one field2 for every uniqueId)</P> <PRE><CODE>EVENT_CONTAIN_SOME_KEYWORD OR EVENT_CONTAIN_ANOTHER_KEYWORD | transaction uniqueId | table uniqueId, field1, field2 </CODE></PRE> <P>I am not using any of those startswith / endswith / maxspan / maxpause args really.<BR /> Is there a way to avoid using transaction, and make my query more efficient?</P> <P>Thanks!</P> Mon, 17 Dec 2018 14:37:17 GMT https://community.splunk.com/t5/Splunk-Search/Is-using-the-transaction-command-an-overkill-in-this-case/m-p/438170#M124732 jliu531 2018-12-17T14:37:17Z https://community.splunk.com/t5/Splunk-Search/Is-using-the-transaction-command-an-overkill-in-this-case/m-p/438171#M124733 <P>Try <CODE>stats</CODE>.</P> <PRE><CODE>EVENT_CONTAIN_SOME_KEYWORD OR EVENT_CONTAIN_ANOTHER_KEYWORD | stats values(field1) as field1, values(field2) as field2 by uniqueId | table uniqueId, field1, field2 </CODE></PRE> Mon, 17 Dec 2018 15:06:12 GMT https://community.splunk.com/t5/Splunk-Search/Is-using-the-transaction-command-an-overkill-in-this-case/m-p/438171#M124733 richgalloway 2018-12-17T15:06:12Z