https://community.splunk.com/t5/Splunk-Search/problem-with-transaction-and-inputlookup/m-p/81408#M20623 <P>Just move the subsearch filter so that it is used after the transactions are created.</P> <PRE><CODE>sourcetype="web_log" | transaction SID | search [| inputlookup xid_lookup.csv | fields XID] </CODE></PRE> Wed, 29 Feb 2012 09:45:38 GMT Ayn 2012-02-29T09:45:38Z https://community.splunk.com/t5/Splunk-Search/problem-with-transaction-and-inputlookup/m-p/81407#M20622 <P>i think i am stuck on this certain for some reason that my head isn't working right when thinking about this problem</P> <P>i have a bunch of web logs that i need to sort out with a certain field (lets say XID) that is only inserted in 1 or 2 lines out of the xxx lines in a complete web transaction<BR /> this web transaction can be defined with an SID for our transaction command<BR /> however, i need to find all the transactions that includes n numbers of XID that i have created in a list of XID lookup table</P> <P>my original search<BR /> sourcetype="web_log" [inputlookup xid_lookup.csv | fields XID] | transaction SID</P> <P>the problem of this search is that it will only given the result of the lines that has the XID in my lookup table<BR /> but what i really want to do is to list out all the lines in transaction by the SID that includes XID in my lookup table only</P> <P>is it possible to do so?</P> Mon, 28 Sep 2020 11:27:40 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-transaction-and-inputlookup/m-p/81407#M20622 cpuppet 2020-09-28T11:27:40Z https://community.splunk.com/t5/Splunk-Search/problem-with-transaction-and-inputlookup/m-p/81408#M20623 <P>Just move the subsearch filter so that it is used after the transactions are created.</P> <PRE><CODE>sourcetype="web_log" | transaction SID | search [| inputlookup xid_lookup.csv | fields XID] </CODE></PRE> Wed, 29 Feb 2012 09:45:38 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-transaction-and-inputlookup/m-p/81408#M20623 Ayn 2012-02-29T09:45:38Z https://community.splunk.com/t5/Splunk-Search/problem-with-transaction-and-inputlookup/m-p/81409#M20624 <P>Ayn thanks alot</P> <P>i think i got where i had it worng in the first place<BR /> your | search [|inputlookup xxx] saved my trouble</P> <P>what i really need...might be this to complete what we are looking for</P> <P>sourcetype ="web_log" | transaction SID XID | search [|inputlookup xid_lookup.csv | fields XID]</P> <P>by this i will be able to filter out the different transactions of SIDs that are included with the particular XID in my table</P> <P>which will also run faster when i add the maxspan for the transaction</P> Mon, 28 Sep 2020 11:27:43 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-transaction-and-inputlookup/m-p/81409#M20624 cpuppet 2020-09-28T11:27:43Z