https://community.splunk.com/t5/Splunk-Search/Nested-transactions/m-p/129236#M35127 <P>I have data records in the following format:</P> <P>Method=OuterTransactionName Type=Start ID=12345</P> <P>Method=InnerTransactionNameAAAA Type=Start ID=12345</P> <P>Method=InnerTransactionNameAAAA Type=End ID=12345</P> <P>Method=InnerTransactionNameBBBB Type=Start ID=12345</P> <P>Method=InnerTransactionNameBBBB Type=End ID=12345<BR /> .<BR /> .<BR /> .</P> <P>Method=InnerTransactionNameZZZZ Type=Start ID=12345</P> <P>Method=InnerTransactionNameZZZZ Type=End ID=12345</P> <P>Method=OuterTransactionName Type=End ID=12345</P> <P>So, every transaction record has the same id, with the outer transaction having a method name different from the inner transaction method names. Not sure how to structure the search to both list and/or find the durations of both the outer transaction as well as the inner transactions</P> Fri, 11 Apr 2014 18:59:15 GMT RVDowning 2014-04-11T18:59:15Z https://community.splunk.com/t5/Splunk-Search/Nested-transactions/m-p/129236#M35127 <P>I have data records in the following format:</P> <P>Method=OuterTransactionName Type=Start ID=12345</P> <P>Method=InnerTransactionNameAAAA Type=Start ID=12345</P> <P>Method=InnerTransactionNameAAAA Type=End ID=12345</P> <P>Method=InnerTransactionNameBBBB Type=Start ID=12345</P> <P>Method=InnerTransactionNameBBBB Type=End ID=12345<BR /> .<BR /> .<BR /> .</P> <P>Method=InnerTransactionNameZZZZ Type=Start ID=12345</P> <P>Method=InnerTransactionNameZZZZ Type=End ID=12345</P> <P>Method=OuterTransactionName Type=End ID=12345</P> <P>So, every transaction record has the same id, with the outer transaction having a method name different from the inner transaction method names. Not sure how to structure the search to both list and/or find the durations of both the outer transaction as well as the inner transactions</P> Fri, 11 Apr 2014 18:59:15 GMT https://community.splunk.com/t5/Splunk-Search/Nested-transactions/m-p/129236#M35127 RVDowning 2014-04-11T18:59:15Z https://community.splunk.com/t5/Splunk-Search/Nested-transactions/m-p/129237#M35128 <P>This should do it (tested on your sample logs)</P> <PRE><CODE>your base search | transaction ID,Method startswith=Type=Start endswith=Type=End </CODE></PRE> Fri, 11 Apr 2014 21:20:03 GMT https://community.splunk.com/t5/Splunk-Search/Nested-transactions/m-p/129237#M35128 somesoni2 2014-04-11T21:20:03Z