https://community.splunk.com/t5/Splunk-Search/annotated-raw-field-in-transactions/m-p/9717#M232 <P>A fairly crude way of seeing the source/sourcetype/host next to each individual event is to concat the value of those fields into _raw before doing the transaction, e.g.</P> <P>… | eval _raw = source . “;” . sourcetype . “;” . host . “;” . _raw | transaction …</P> <UL> <LI>SteveZ</LI> </UL> Fri, 12 Feb 2010 02:22:17 GMT Ledion_Bitincka 2010-02-12T02:22:17Z https://community.splunk.com/t5/Splunk-Search/annotated-raw-field-in-transactions/m-p/9716#M231 <P>Dan Goldburt asks:<BR /><BR /> I'm consistently getting the following request from customers: "can I see where each event came from?". If they have this 150+ line transaction and want to scan through it, it helps to see the host, sourcetype, etc... next to each component event. (for a deep dive, I attached an email where I was working on this for another customer and couldn't come up with a satisfactory answer). Has anyone else heard this complaint?</P> Fri, 12 Feb 2010 02:21:14 GMT https://community.splunk.com/t5/Splunk-Search/annotated-raw-field-in-transactions/m-p/9716#M231 Ledion_Bitincka 2010-02-12T02:21:14Z https://community.splunk.com/t5/Splunk-Search/annotated-raw-field-in-transactions/m-p/9717#M232 <P>A fairly crude way of seeing the source/sourcetype/host next to each individual event is to concat the value of those fields into _raw before doing the transaction, e.g.</P> <P>… | eval _raw = source . “;” . sourcetype . “;” . host . “;” . _raw | transaction …</P> <UL> <LI>SteveZ</LI> </UL> Fri, 12 Feb 2010 02:22:17 GMT https://community.splunk.com/t5/Splunk-Search/annotated-raw-field-in-transactions/m-p/9717#M232 Ledion_Bitincka 2010-02-12T02:22:17Z