topic Re: Using Transaction command with two extracted join fields in Splunk Search

How to use Transaction command with two extracted join fields?

jbrenner — Tue, 19 Apr 2022 15:50:53 GMT

I have two Splunk queries, each of which uses the _rex command to extract the join field.

Example:

QUERY 1 index=index1 "Query1" | rex field=_raw "abc(?<MY_JOIN_FIELD>def)" QUERY 2 index=index2 "Query2" | rex field=_raw "ghi(?<MY_JOIN_FIELD>jkl)"

I want to use the Transaction command to correlate these two queries, but I can't figure out how to do it.

Thanks!

Jonathan

Re: Using Transaction command with two extracted join fields

gcusello — Tue, 19 Apr 2022 15:51:40 GMT

Hi @jbrenner ,

you should try something like this:

otherwise, you could extract both the MY_JOIN_FIELD before so you don't need to extract them in the search, in other words:

index=index1 OR index=index2 | transaction <MY_JOIN_FIELD> | ...

But i invite you to think in a different way:

At first extract the two fields before and then try to use stats command instead of transaction:

index=index1 OR index=index2 | stats values(field1) AS field1 values(field2) AS field2 values(field3) AS field3 BY <MY_JOIN_FIELD>

where field1, field2 and field3 are the fields you need in your events.

This solution is very much performant than using transaction.

Ciao.

Giuseppe

Re: Using Transaction command with two extracted join fields

gcusello — Tue, 19 Apr 2022 16:10:21 GMT

Hi @jbrenner,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Using Transaction command with two extracted join fields

jbrenner — Tue, 19 Apr 2022 16:13:11 GMT

@gcusello Thanks Giuseppe! Worked like a charm! I originally considered your alternative solution, but this is a one-off scenario, and it's unlikely we will ever use these extracted fields again.