topic Re: How to Display transaction result in a table in Splunk Search

How to Display transaction result in a table

smolcj — Wed, 06 Feb 2013 04:36:33 GMT

Hi,
I have a search using transaction command
mysearch | transaction startswith=start endswith=end
and I am getting several events as one event, i would like those events to be displayed in a table.

Is it possible to do so??
please help
Thank you

Re: How to Display transaction result in a table

smolcj — Wed, 06 Feb 2013 06:03:34 GMT

something related to this, but i my transaction uses startwith and endswith, i need tables in expanded form, now they are displaying as if i used list() ot values() i want it to be exactly like a normal table... any thoughts????
please help

Re: How to Display transaction result in a table

Ayn — Wed, 06 Feb 2013 09:42:56 GMT

So you're combining multiple events into one event, then you want that event to be displayed as...multiple events again?

Re: How to Display transaction result in a table

dart — Wed, 06 Feb 2013 11:12:32 GMT

smolcj, can you explain your use case more fully?

Re: How to Display transaction result in a table

bellaed — Wed, 06 Feb 2013 11:30:52 GMT

a table command after transaction can do the job

Re: How to Display transaction result in a table

smolcj — Wed, 06 Feb 2013 12:58:09 GMT

Hi,
i dont want events as multivalued as because these events can be read through transaction command i did so.
i wan them to be in tables

Re: How to Display transaction result in a table

Ayn — Wed, 06 Feb 2013 13:00:56 GMT

Which events, the pre-transaction individual events or the combined events that transaction creates?

Re: How to Display transaction result in a table

smolcj — Wed, 06 Feb 2013 13:03:26 GMT

Ayn, combined events that transaction creates should be displayed in tables and thereafter i have to use re-director to one of the field like severity.. i need to display all the events between specific keywords that is the reason i used transaction command

Re: How to Display transaction result in a table

Ayn — Wed, 06 Feb 2013 13:23:20 GMT

So if it's the combined events you want to show, what's stopping you from using table?

Re: How to Display transaction result in a table

kristian_kolb — Wed, 06 Feb 2013 14:38:57 GMT

I think a good idea would be to provide a few sample events, and a sketch of how you want the output.

Re: How to Display transaction result in a table

smolcj — Thu, 07 Feb 2013 04:53:39 GMT

My log events are like this

timestamp ... event start ..
.
....some other events
.
timestamp... event end
.
.
timestamp..another eventstart
.
.
event end

So inorder to display all the events between start and stop i used transaction command
... | transaction startswith= "event star" ends with ="event end".. but i want those events to be displayed in tables.. How could i , is there any other alternative for transaction command?
Please help

Re: How to Display transaction result in a table

MuS — Thu, 07 Feb 2013 06:56:01 GMT

as Ayn already stated, why don't just use the table command next?

Re: How to Display transaction result in a table

smolcj — Thu, 07 Feb 2013 06:59:48 GMT

i am not getting proper table .. the values are deduplicated , for example if the severity is info for 5 events, it will show only once, something like we used values(field) or list (field).. i am in need of exact table 😞

Re: How to Display transaction result in a table

MuS — Thu, 07 Feb 2013 08:56:58 GMT

like kkolb said: provide some samples, real samples of your log events. perhaps we are then able to help.....

Re: How to Display transaction result in a table

smolcj — Mon, 28 Sep 2020 13:15:07 GMT

I am using this search index=main source=file.txt|transaction startswith=TM_6000 endswith=TM_6020 maxevents=10000
and my output is like
It looks so crappy and i am not able to use redirection for this ... appending a table command after transaction gives

i want it as a normal table that i can provide external links to some of the field

Re: How to Display transaction result in a table

gwallin042 — Sun, 21 Apr 2013 05:19:13 GMT

I think you want:

mysearch | transaction startswith=start endswith=end mvlist=t | table field1, field2, field3

By default transaction will "group" like values, mvlist tells it to display repeated values in your resulting table

The next issue i haven't figured out yet will be if you need to export the results. . .

Re: How to Display transaction result in a table

nmulm — Fri, 22 Sep 2017 08:27:45 GMT

Just to follow up as I had a similar issue, I think that you can get all the lines that each transaction returns into a single row by using _raw as your field e.g.

transaction | table _raw field1 field2 etc etc