https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32202#M178167 <P>Thx Kristian and wpreston for your answers. Transaction surely helps me ..</P> Tue, 14 May 2013 22:14:08 GMT joshy_m 2013-05-14T22:14:08Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32199#M178164 <P>Hi,</P> <P>I am pretty much new to Splunk and was exploring various options. There is a specific case in our project where in we need to capture a transation completely. The transaction can be identifed by a start string and an end string<BR /> e.g<BR /> Started the Event 123456<BR /> XXXX<BR /> YYY<BR /> ZZZ<BR /> AAAA<BR /> BBBB<BR /> Completed the event 123456</P> <P>The above example illustrates the specific set of activity by an event and the only identifier to capture the event is the ID and I want all the log traces between those two lines(start and completed).</P> <P>Can we do this using Splunk? If so, can I get some tips on this?<BR /> I did some work by searching the strings, ids etc but all I can get, was just the line not the entire transaction from that event.</P> <P>Appreciate any help</P> Mon, 13 May 2013 23:38:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32199#M178164 joshy_m 2013-05-13T23:38:25Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32200#M178165 <P>There is a command called <CODE>transaction</CODE>, which will operate with specific start/stop indicators, like you have outlined.</P> <P>If you have a common transaction-id in each event of the transaction, you can also use that to 'group by' so-to-speak.</P> <P>Best of all is that you update your question with a couple of sample events, as it's much easier to advise you then.</P> <P>/Kristian</P> Tue, 14 May 2013 05:28:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32200#M178165 kristian_kolb 2013-05-14T05:28:05Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32201#M178166 <P>I agree with kristian.kolb, some anonymized sample events would be helpful as there are many different options when creating transactions.</P> Tue, 14 May 2013 12:24:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32201#M178166 wpreston 2013-05-14T12:24:20Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32202#M178167 <P>Thx Kristian and wpreston for your answers. Transaction surely helps me ..</P> Tue, 14 May 2013 22:14:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32202#M178167 joshy_m 2013-05-14T22:14:08Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32203#M178168 <P>Thx Kristian and wpreston for your answers. Transaction surely helps me ..</P> Tue, 14 May 2013 22:14:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32203#M178168 joshy_m 2013-05-14T22:14:23Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32204#M178169 <P>Thx Kristian.. It helped</P> Tue, 14 May 2013 22:15:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32204#M178169 joshy_m 2013-05-14T22:15:02Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32205#M178170 <P>Thank you. It helped</P> Tue, 14 May 2013 22:15:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-the-transations-of-an-event/m-p/32205#M178170 joshy_m 2013-05-14T22:15:25Z