https://community.splunk.com/t5/Splunk-Search/Transaction-using-regex-or-event-1/m-p/138106#M37882 <P>I have found a solution.</P> <P>The solution I encountered is to create a new sourcetype and use the "SHOULD_LINEMERGE" boolean attribute with the property of BREAK_ONLY_BEFORE set with the regex of where the new statements should start.</P> <P>Hope this helps</P> Mon, 28 Sep 2020 18:54:43 GMT markthompson 2020-09-28T18:54:43Z https://community.splunk.com/t5/Splunk-Search/Transaction-using-regex-or-event-1/m-p/138105#M37881 <P>Hello,<BR /> I'm using a transaction command and what I want to do is find the next event that has the format "{DATE} INFO"<BR /> and then use the event previous to the found event.</P> <P>Any ideas?</P> <P>For example, endswith="{SEARCH}-1"</P> Mon, 16 Feb 2015 13:39:26 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-using-regex-or-event-1/m-p/138105#M37881 markthompson 2015-02-16T13:39:26Z https://community.splunk.com/t5/Splunk-Search/Transaction-using-regex-or-event-1/m-p/138106#M37882 <P>I have found a solution.</P> <P>The solution I encountered is to create a new sourcetype and use the "SHOULD_LINEMERGE" boolean attribute with the property of BREAK_ONLY_BEFORE set with the regex of where the new statements should start.</P> <P>Hope this helps</P> Mon, 28 Sep 2020 18:54:43 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-using-regex-or-event-1/m-p/138106#M37882 markthompson 2020-09-28T18:54:43Z