https://community.splunk.com/t5/Splunk-Search/How-to-join-2-results-and-use-transaction-to-display-calls/m-p/118158#M31518 <P>Thanks. this really helped. But, I am seeing same URLs in one transaction for most of the results and I want to display transaction results only if the URLs are different like the one below</P> <P>2014-11-13 22:59:49 0.357 3152 2b76f0999150450e9b4a8c95e805ba41 - XXXXXX 00.00.00.00 00.00.00.00 00.00.00.00 00.00.00.00 GET /bankapi/ABCD 200 isExternal <BR /> 2014-11-13 22:59:52 0.301 3152 2b76f0999150450e9b4a8c95e805ba41 - XXXXXX 00.00.00.00 00.00.00.00 00.00.00.00 00.00.00.00 GET /bankapi/EFGH 200 isExternal</P> Fri, 14 Nov 2014 20:42:13 GMT edookati 2014-11-14T20:42:13Z https://community.splunk.com/t5/Splunk-Search/How-to-join-2-results-and-use-transaction-to-display-calls/m-p/118156#M31516 <P>in weblogic access log, i need to join 2 results and use transaction to display the calls within 3s timespan, but this doesn't work.<BR /> Can you please help me?</P> <PRE><CODE>index=olb_logs sourcetype="access-API" URL="/bankapi/session" method=POST | join sessionID [Search URL="/bankapi/accounts" method=GET] | transaction sessionID maxspan=3s </CODE></PRE> Fri, 14 Nov 2014 20:25:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-2-results-and-use-transaction-to-display-calls/m-p/118156#M31516 edookati 2014-11-14T20:25:01Z https://community.splunk.com/t5/Splunk-Search/How-to-join-2-results-and-use-transaction-to-display-calls/m-p/118157#M31517 <P>Try this</P> <PRE><CODE>index=olb_logs sourcetype="access-API" (URL="/bankapi/session" method=POST ) OR (URL="/bankapi/accounts" method=GET) | transaction sessionID maxspan=3s </CODE></PRE> Fri, 14 Nov 2014 20:31:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-2-results-and-use-transaction-to-display-calls/m-p/118157#M31517 somesoni2 2014-11-14T20:31:15Z https://community.splunk.com/t5/Splunk-Search/How-to-join-2-results-and-use-transaction-to-display-calls/m-p/118158#M31518 <P>Thanks. this really helped. But, I am seeing same URLs in one transaction for most of the results and I want to display transaction results only if the URLs are different like the one below</P> <P>2014-11-13 22:59:49 0.357 3152 2b76f0999150450e9b4a8c95e805ba41 - XXXXXX 00.00.00.00 00.00.00.00 00.00.00.00 00.00.00.00 GET /bankapi/ABCD 200 isExternal <BR /> 2014-11-13 22:59:52 0.301 3152 2b76f0999150450e9b4a8c95e805ba41 - XXXXXX 00.00.00.00 00.00.00.00 00.00.00.00 00.00.00.00 GET /bankapi/EFGH 200 isExternal</P> Fri, 14 Nov 2014 20:42:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-2-results-and-use-transaction-to-display-calls/m-p/118158#M31518 edookati 2014-11-14T20:42:13Z https://community.splunk.com/t5/Splunk-Search/How-to-join-2-results-and-use-transaction-to-display-calls/m-p/118159#M31519 <P>Try adding maxevents=2 in the transaction command.</P> Fri, 14 Nov 2014 21:06:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-2-results-and-use-transaction-to-display-calls/m-p/118159#M31519 somesoni2 2014-11-14T21:06:50Z https://community.splunk.com/t5/Splunk-Search/How-to-join-2-results-and-use-transaction-to-display-calls/m-p/118160#M31520 <P>Sorry, it is still giving me the same URLs in one transaction.</P> Fri, 14 Nov 2014 21:17:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-2-results-and-use-transaction-to-display-calls/m-p/118160#M31520 edookati 2014-11-14T21:17:31Z