https://community.splunk.com/t5/Splunk-Search/How-does-the-searchtxn-command-work/m-p/147175#M185296 <P>yes i read. and i didn't understand this example. </P> Wed, 10 Jun 2015 12:09:28 GMT kozhin 2015-06-10T12:09:28Z https://community.splunk.com/t5/Splunk-Search/How-does-the-searchtxn-command-work/m-p/147173#M185294 <P>Hello i have a problem with searchtxn:</P> <PRE><CODE>"Error in 'searchtxn' command: This command must be the first command of a search." </CODE></PRE> <P>and i don't understand how to use it correctly. i have events from one sourcetype and i need to paste them together. They have same number of device "645", but because i have a very long search with rex, i don't know how to paste them. Help me pls how to write correctly searchtxn</P> Wed, 10 Jun 2015 10:02:57 GMT https://community.splunk.com/t5/Splunk-Search/How-does-the-searchtxn-command-work/m-p/147173#M185294 kozhin 2015-06-10T10:02:57Z https://community.splunk.com/t5/Splunk-Search/How-does-the-searchtxn-command-work/m-p/147174#M185295 <P>Hello! Did you read the manual? <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Searchtxn">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Searchtxn</A> <BR /> Take a look at it, and let me know if any issue.</P> Wed, 10 Jun 2015 12:03:02 GMT https://community.splunk.com/t5/Splunk-Search/How-does-the-searchtxn-command-work/m-p/147174#M185295 stephanefotso 2015-06-10T12:03:02Z https://community.splunk.com/t5/Splunk-Search/How-does-the-searchtxn-command-work/m-p/147175#M185296 <P>yes i read. and i didn't understand this example. </P> Wed, 10 Jun 2015 12:09:28 GMT https://community.splunk.com/t5/Splunk-Search/How-does-the-searchtxn-command-work/m-p/147175#M185296 kozhin 2015-06-10T12:09:28Z https://community.splunk.com/t5/Splunk-Search/How-does-the-searchtxn-command-work/m-p/147176#M185297 <P>The manual is clear. The command Efficiently retrieves transaction events matching the transaction type <STRONG>transaction-name</STRONG> that contain the text selected by <STRONG>search-string</STRONG>.<BR /> The example bellow, will Find all <STRONG>email</STRONG> transactions to <STRONG>root</STRONG> from <STRONG>David Smith</STRONG>.</P> <PRE><CODE>| searchtxn email to=root from="David Smith" </CODE></PRE> <P>If you still have problems, let me get your query</P> Wed, 10 Jun 2015 13:01:51 GMT https://community.splunk.com/t5/Splunk-Search/How-does-the-searchtxn-command-work/m-p/147176#M185297 stephanefotso 2015-06-10T13:01:51Z