https://community.splunk.com/t5/Splunk-Search/How-to-use-transaction-command-with-message-and-as-argument/m-p/355980#M162227 <P>Sorry, I can't .</P> Fri, 16 Mar 2018 05:50:34 GMT abhi04 2018-03-16T05:50:34Z https://community.splunk.com/t5/Splunk-Search/How-to-use-transaction-command-with-message-and-as-argument/m-p/355978#M162225 <P>How to use message name as argument for transaction command? I have logs relate to a particular message ID for one source type or an app say A but don't see any logs for the same message ID in another source type or app say B but when login to the server of app B,can see the logs related to app B.</P> Fri, 16 Mar 2018 05:04:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-transaction-command-with-message-and-as-argument/m-p/355978#M162225 abhi04 2018-03-16T05:04:13Z https://community.splunk.com/t5/Splunk-Search/How-to-use-transaction-command-with-message-and-as-argument/m-p/355979#M162226 <P>Can you provide some sample data?</P> Fri, 16 Mar 2018 05:41:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-transaction-command-with-message-and-as-argument/m-p/355979#M162226 p_gurav 2018-03-16T05:41:17Z https://community.splunk.com/t5/Splunk-Search/How-to-use-transaction-command-with-message-and-as-argument/m-p/355980#M162227 <P>Sorry, I can't .</P> Fri, 16 Mar 2018 05:50:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-transaction-command-with-message-and-as-argument/m-p/355980#M162227 abhi04 2018-03-16T05:50:34Z https://community.splunk.com/t5/Splunk-Search/How-to-use-transaction-command-with-message-and-as-argument/m-p/355981#M162228 <P>You can pass field name while doing transaction. Refer below doc :<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction#Extended_Examples">https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction#Extended_Examples</A></P> <P>ALso if data is not coming from app_B, can you run below command on server of appB:</P> <PRE><CODE>.\splunk list monitor </CODE></PRE> <P>And check data is being monitored or not?</P> Fri, 16 Mar 2018 06:02:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-transaction-command-with-message-and-as-argument/m-p/355981#M162228 p_gurav 2018-03-16T06:02:28Z https://community.splunk.com/t5/Splunk-Search/How-to-use-transaction-command-with-message-and-as-argument/m-p/355982#M162229 <P>Hello!<BR /> You could use something like this </P> <PRE><CODE>| transaction message_id </CODE></PRE> <P>Let me know if this works </P> Fri, 16 Mar 2018 06:13:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-transaction-command-with-message-and-as-argument/m-p/355982#M162229 bangalorep 2018-03-16T06:13:59Z