https://community.splunk.com/t5/Splunk-Search/transaction-or-join-where-the-search-field-changes-but-another/m-p/119141#M31915 <P>Hi I have a log with entries similar to below</P> <P>11:32:12,988 INFO [LOG TYPE: REQUEST] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...<BR /> 11:32:14,364 SEVERE [LOG TYPE:EXCEPTION] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...<BR /> 11:32:14,364 INFO [LOG TYPE:RESPONSE] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...</P> <P>What I'm looking for is a search which displays all 3 which have the same REQUEST ID if it finds a SEVERE or LOG TYPE:EXCEPTION</P> <P>Transaction almost sounds like what I want so I tried the following</P> <P>sourcetype=cas SEVERE | transaction RequestId maxspan=5s maxpause=5s</P> <P>However this only brings back the SEVERE entry.</P> <P>Is there a way to do this with transaction or should I be looking at JOIN?</P> <P>Thanks for your assistance</P> Thu, 21 May 2015 06:12:28 GMT stewartevans 2015-05-21T06:12:28Z https://community.splunk.com/t5/Splunk-Search/transaction-or-join-where-the-search-field-changes-but-another/m-p/119141#M31915 <P>Hi I have a log with entries similar to below</P> <P>11:32:12,988 INFO [LOG TYPE: REQUEST] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...<BR /> 11:32:14,364 SEVERE [LOG TYPE:EXCEPTION] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...<BR /> 11:32:14,364 INFO [LOG TYPE:RESPONSE] [REQUEST ID:46783e96-e146-4d35-9a3a-5ff95226a8bb] ...</P> <P>What I'm looking for is a search which displays all 3 which have the same REQUEST ID if it finds a SEVERE or LOG TYPE:EXCEPTION</P> <P>Transaction almost sounds like what I want so I tried the following</P> <P>sourcetype=cas SEVERE | transaction RequestId maxspan=5s maxpause=5s</P> <P>However this only brings back the SEVERE entry.</P> <P>Is there a way to do this with transaction or should I be looking at JOIN?</P> <P>Thanks for your assistance</P> Thu, 21 May 2015 06:12:28 GMT https://community.splunk.com/t5/Splunk-Search/transaction-or-join-where-the-search-field-changes-but-another/m-p/119141#M31915 stewartevans 2015-05-21T06:12:28Z https://community.splunk.com/t5/Splunk-Search/transaction-or-join-where-the-search-field-changes-but-another/m-p/119142#M31916 <P>Comment for now as I'm half asleep spinning a theory:</P> <P>One thought is search for all records with a RequestId, do the transaction, and then use either a search or where command to filter the results to only include those. e.g.</P> <PRE><CODE>sourcetype=cas RequestId=* | transaction RequestId ... | search SEVERE </CODE></PRE> Thu, 21 May 2015 06:28:30 GMT https://community.splunk.com/t5/Splunk-Search/transaction-or-join-where-the-search-field-changes-but-another/m-p/119142#M31916 acharlieh 2015-05-21T06:28:30Z https://community.splunk.com/t5/Splunk-Search/transaction-or-join-where-the-search-field-changes-but-another/m-p/119143#M31917 <P>acharlieh you are a genius! It works!!</P> Thu, 21 May 2015 06:32:39 GMT https://community.splunk.com/t5/Splunk-Search/transaction-or-join-where-the-search-field-changes-but-another/m-p/119143#M31917 stewartevans 2015-05-21T06:32:39Z https://community.splunk.com/t5/Splunk-Search/transaction-or-join-where-the-search-field-changes-but-another/m-p/119144#M31918 <P>Well excellent then! converted comment to an answer.</P> Thu, 21 May 2015 06:34:53 GMT https://community.splunk.com/t5/Splunk-Search/transaction-or-join-where-the-search-field-changes-but-another/m-p/119144#M31918 acharlieh 2015-05-21T06:34:53Z https://community.splunk.com/t5/Splunk-Search/transaction-or-join-where-the-search-field-changes-but-another/m-p/119145#M31919 <P>Cheers, thanks for such a quick response</P> Thu, 21 May 2015 06:36:05 GMT https://community.splunk.com/t5/Splunk-Search/transaction-or-join-where-the-search-field-changes-but-another/m-p/119145#M31919 stewartevans 2015-05-21T06:36:05Z