topic transaction command in Splunk Search

transaction command

riqbal47010 — Mon, 13 Jan 2020 08:04:03 GMT

I have many events against session_id. but I am interested to only list down three type of events

1- AD authentication successful
2- RADUS authentication successful
3- SMS generated

Please advise

Re: transaction command

efavreau — Mon, 13 Jan 2020 13:59:10 GMT

There could be many ways to optimize your query, if you provided one. However, with the information you provided, I might start with the text of those events and put that text in my base query. Let's say your "AD authentication successful" has that actual text in the events. Then in your base query (meaning the query before the first pipe):

index=yourindex source=yoursource sourcetype=yoursourcetype "*AD authentication successful*" rest of your base query
| your other statements
| transaction command details

Then when you run the query, your base query has already filtered down to the information you are looking for. As making your base query as specific as possible is also a best practice, you will gain the additional benefit of having a faster query.

Re: transaction command

rmmiller — Mon, 13 Jan 2020 15:46:45 GMT

Also need to make sure that if "| your other statements" changes the order of the events, you'll need to use the sort command to put them back in reverse time order. The transaction command requires that.