topic Using multivalue field as field-list for transaction in Splunk Search

Using multivalue field as field-list for transaction

Puliyo — Wed, 24 Jun 2020 01:31:01 GMT

When multivalue field is given as field-list for transaction, transaction does not attempt to combine the events despite the events have common multivalue field.

Example Query:

I'd expect all 4 events to be combined to 1 as all events have common value of "123".

However this is not the case.

Is there any way to make this happen?

Re: Using multivalue field as field-list for transaction

Puliyo — Wed, 24 Jun 2020 01:42:45 GMT

Guess I've figured it out myself.

Solution is to specify all the fields in field-list.

| transaction abc,def,ghi keeporphans=1 keepevicted=1

Re: Using multivalue field as field-list for transaction

bowesmana — Wed, 24 Jun 2020 01:50:14 GMT

Changing the mvappend to make them a sorted single value will give you a transaction on events where abc has the same set of MV values

| eval abc=mvjoin(mvsort(mvdedup(mvappend(abc, def, ghi))),",")

but not where any of the individual values has a common value. Not sure if that would be possible. I suspect you would have to run mvexpand on the value of abc to create separate events for that distinct value before running the transaction.