Why is Transaction command not working as expected?

indeed_2000 — Tue, 31 May 2022 13:58:35 GMT

I encounter with strange issue when i use transaction and at the end sort by duration it show highest duration is 15000 but when i remove transaction it show 17000 as highest duration!!!

FYI1:correct value is 17000 and there is no special filter exist here!

FYI2:duration directly print in log i just use transaction to aggregate two lines.

Here is with transaction command:

Here is without transaction:

Here is the log:
2022-05-30 12:39:34,262 INFO [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] parameters[] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] username[ABC] startTime[1653898174262]

2022-05-30 12:42:26,109 INFO [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] duration[171847] status[done]

any idea?

Thanks

Re: Transaction command not work as expcted

ITWhisperer — Tue, 31 May 2022 06:14:34 GMT

duration is a field that is (also) generated by the transaction command so the value you are extracting from the event (with rex) is getting overridden by the transaction command - try a different field name - even capitalising might work

 |  rex "actionName\[(\w+\.)*\.(?<actionName>\w+\.\w+)\]" | rex "duration\[(?<Duration>\d+)"
 | rex "transactionId\[(?<transactionId>\w+-\w+-\w+-\w+-\w+)"
 | transaction transactionId | sort - Duration
 | table Duration actionName username

topic Why is Transaction command not working as expected? in Splunk Search

Why is Transaction command not working as expected?

Re: Transaction command not work as expcted