topic Why when I use transaction command, search is not extracting some fields in Splunk Search

Why when I use transaction command, search is not extracting some fields

indeed_2000 — Tue, 31 May 2022 13:55:40 GMT

try to use transaction command, but actionName is empty!

Here is my SPL

Here is the current result:

duration actionName username
171847 ABC

Here is the expected result:

duration actionName username
171847 QueryOnData.Allow ABC

Here is the log:
2022-05-30 12:39:34,262 INFO [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] parameters[] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] username[ABC] startTime[1653898174262]

2022-05-30 12:42:26,109 INFO [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] duration[171847] status[done]

Re: transaction command not extract some fields

ITWhisperer — Mon, 30 May 2022 16:32:19 GMT

You have extracted actionName as method - try it this way

| rex "actionName.*\.(?<actionName>\w+\.\w+)\]"

Re: transaction command not extract some fields

indeed_2000 — Mon, 30 May 2022 16:38:34 GMT

sorry it was typo, modify post. result same and still not work.

Re: transaction command not extract some fields

ITWhisperer — Mon, 30 May 2022 16:53:07 GMT

There doesn't appear to be anything wrong with your rex expressions (given the examples you provided). However, you could try it this way

| rex "actionName\[(\w+\.)*(?<actionName>\w+\.\w+)\]"

Re: transaction command not extract some fields

indeed_2000 — Mon, 30 May 2022 17:29:28 GMT

Thank you now actionName show correctly .

I encounter with another strange issue when i use transaction and at the end sort by duration it show highest duration is 15000 but when i remove transaction it show 17000 as highest duration!!!

FYI1:correct value is 17000 and there is no special filter exist here!

FYI2:duration directly print in log i just use transaction to aggregate two lines.

Here is with transaction command:

Here is without transaction:

any idea?

Thanks

Re: transaction command not extract some fields

ITWhisperer — Tue, 31 May 2022 06:17:31 GMT

Answered here Re: Transaction command not work as expcted - Splunk Community