topic Re: Transaction on eval field in Splunk Search

Transaction on eval field

brettcave — Thu, 04 Oct 2012 14:58:46 GMT

Is it possible to create a transaction on an eval field after passing through stats?

... | stats sum(total) as total sum(units) as units by AccountID Action Item | transaction mvlist=t AccountID

AccountID is a field created by an extractor, when I try run the transaction after stats, I get no results. There are a handful of eval's prior to the stats command.

Re: Transaction on eval field

Ayn — Thu, 04 Oct 2012 15:27:33 GMT

From the transaction page in the search reference:

Given events as input, finds transactions based on events that meet various constraints. Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member.

When you've run stats, there is no longer a _raw field for transaction to use.

Your search looks kind of weird - what do you want to use transaction on your stats results for?

Re: Transaction on eval field

brettcave — Fri, 05 Oct 2012 07:25:27 GMT

purely for report layout purposes. I want the left column to have the AccountID (once) and then the next column to list the items. When using a transaction, i can display multiple fields. I guess I could use something like the stats list function.

Edit
Have just tested and list works perfectly:

... | stats list(Item) as Item list(units) as Units list(total) as Total by AccountID Action

Re: Transaction on eval field

Ayn — Fri, 05 Oct 2012 09:28:20 GMT

Yeah, I was thinking something along those lines 🙂

Good that you got it working!