https://community.splunk.com/t5/Splunk-Search/Transaction-after-stats-table-eval-where/m-p/53211#M12934 <P>No, once you've run a command that transforms the results in one way or another, the following commands in the search pipeline will only see the output of that command, so for instance after running <CODE>stats</CODE> the following commands do not 'see' the original events.</P> <P>What you could do though is to put this in a subsearch for getting the userId's that you want to report on first, and then return those to the main search where you get the times for each of those userId's:</P> <PRE><CODE>source="thesource" A="enterEvent" [search source="thesource" A="enterEvent" | stats first(_time) as firstime last(_time) as lastime by userId | table firstime lastime userId | eval time_difference=(lastime-firstime)/3600 | where diff&gt;"12" | fields userId] | table _time userId </CODE></PRE> Wed, 16 May 2012 16:46:48 GMT Ayn 2012-05-16T16:46:48Z https://community.splunk.com/t5/Splunk-Search/Transaction-after-stats-table-eval-where/m-p/53210#M12933 <P>Hi, is it possible to manipulate the events of a query with a transaction after using stats/table/eval/where?<BR /> the events are kept no matter what I do to them in the query, maybe they reduce in numbers but the remaining results are the important ones for a possible transaction.</P> <P>For example:</P> <PRE><CODE>source="thesource" A="enterEvent" | stats first(_time) as firstime last(_time) as lastime by userId | table firstime lastime userId | eval time_difference=(lastime-firstime)/3600 | where diff&gt;"12" | transaction userId | table _time userId </CODE></PRE> <P>(obviously I don't have <CODE>_time</CODE> anymore in my results, but can't I reuse it from the remaining events?)</P> Wed, 16 May 2012 16:30:23 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-after-stats-table-eval-where/m-p/53210#M12933 Yarsa 2012-05-16T16:30:23Z https://community.splunk.com/t5/Splunk-Search/Transaction-after-stats-table-eval-where/m-p/53211#M12934 <P>No, once you've run a command that transforms the results in one way or another, the following commands in the search pipeline will only see the output of that command, so for instance after running <CODE>stats</CODE> the following commands do not 'see' the original events.</P> <P>What you could do though is to put this in a subsearch for getting the userId's that you want to report on first, and then return those to the main search where you get the times for each of those userId's:</P> <PRE><CODE>source="thesource" A="enterEvent" [search source="thesource" A="enterEvent" | stats first(_time) as firstime last(_time) as lastime by userId | table firstime lastime userId | eval time_difference=(lastime-firstime)/3600 | where diff&gt;"12" | fields userId] | table _time userId </CODE></PRE> Wed, 16 May 2012 16:46:48 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-after-stats-table-eval-where/m-p/53211#M12934 Ayn 2012-05-16T16:46:48Z