https://community.splunk.com/t5/Splunk-Search/Transaction-command-causing-zero-results/m-p/81170#M20533 <P>You sir, have solved my dilemma. Thank you.</P> Thu, 21 Jun 2012 19:43:23 GMT mrjester 2012-06-21T19:43:23Z https://community.splunk.com/t5/Splunk-Search/Transaction-command-causing-zero-results/m-p/81168#M20531 <P>I have events that come in on a webform save action that logs the value pairs of all data elements. They look something like this.</P> <PRE><CODE>06/21/2012 06:26:18 AM LogName=Application SourceName=WebAsset EventCode=10001 EventType=4 Type=Information ComputerName=dev-web Category=0 CategoryString=none RecordNumber=90606 Message=Message=Save @objId=641 @user=Admin1 @rqstrName=James Doe @alt1RqstrName=Jane Doe </CODE></PRE> <P>objId is the key value for the records.</P> <P>I am trying to display changes per objId over time, but only if there are changes.</P> <PRE><CODE>sourcetype="WinEventLog:Application" "SourceName=WebAsset" | stats count as events by a_objId | eval include = if(events &gt; 1,1,0) | search include=1 </CODE></PRE> <P>This query works fine and returns all expected results and all fields are still available.</P> <P>When I add transaction a_objId to the end, it returns zero results. </P> <PRE><CODE>sourcetype="WinEventLog:Application" "SourceName=WebAsset" | stats count as events by a_objId | eval include = if(events &gt; 1,1,0) | search include=1| transaction a_objId </CODE></PRE> <P>Running this search shows multiple raw events for the objId still in the results.</P> <PRE><CODE>sourcetype="WinEventLog:Application" "SourceName=WebAsset" a_objId=&lt;value&gt; | stats count as events by a_objId | eval include = if(events &gt; 1,1,0) | search include=1 </CODE></PRE> <P>This search returns the desired results, just not filtered for for objIds with multiple events.</P> <PRE><CODE>sourcetype="WinEventLog:Application" "SourceName=WebAsset" | transaction a_objId </CODE></PRE> <P>Any ideas on what I am doing wrong here?</P> Thu, 21 Jun 2012 16:52:02 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-command-causing-zero-results/m-p/81168#M20531 mrjester 2012-06-21T16:52:02Z https://community.splunk.com/t5/Splunk-Search/Transaction-command-causing-zero-results/m-p/81169#M20532 <P>I think you're going to have trouble using transaction after a summarizing command like stats. Can you use the eventcount field of transaction to do what you want?<BR /> <PRE><CODE><BR /> sourcetype="WinEventLog:Application" "SourceName=WebAsset" | transaction a_objId | where eventcount &gt; 1<BR /> </CODE></PRE></P> Thu, 21 Jun 2012 17:55:43 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-command-causing-zero-results/m-p/81169#M20532 cphair 2012-06-21T17:55:43Z https://community.splunk.com/t5/Splunk-Search/Transaction-command-causing-zero-results/m-p/81170#M20533 <P>You sir, have solved my dilemma. Thank you.</P> Thu, 21 Jun 2012 19:43:23 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-command-causing-zero-results/m-p/81170#M20533 mrjester 2012-06-21T19:43:23Z