topic Re: How do I separate the results of a transaction to separately show each event? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-separate-the-results-of-a-transaction-to-separately/m-p/229697#M68038 <P>What is the query that you're using to generate the results?</P> Tue, 12 Jan 2016 11:52:18 GMT fdi01 2016-01-12T11:52:18Z How do I separate the results of a transaction to separately show each event? https://community.splunk.com/t5/Splunk-Search/How-do-I-separate-the-results-of-a-transaction-to-separately/m-p/229696#M68037 <P>Hi at all,</P> <P>I have to separate the results of a transaction to separately show each event.<BR /> I'd like to do this because I have to aggregate events into a transaction to verify some rules (eventcount), but after, I'd like to separately show events.</P> <P>How can I do this?<BR /> thank you.<BR /> Bye.<BR /> Giuseppe</P> Tue, 12 Jan 2016 11:38:04 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-separate-the-results-of-a-transaction-to-separately/m-p/229696#M68037 gcusello 2016-01-12T11:38:04Z Re: How do I separate the results of a transaction to separately show each event? https://community.splunk.com/t5/Splunk-Search/How-do-I-separate-the-results-of-a-transaction-to-separately/m-p/229697#M68038 <P>What is the query that you're using to generate the results?</P> Tue, 12 Jan 2016 11:52:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-separate-the-results-of-a-transaction-to-separately/m-p/229697#M68038 fdi01 2016-01-12T11:52:18Z Re: How do I separate the results of a transaction to separately show each event? https://community.splunk.com/t5/Splunk-Search/How-do-I-separate-the-results-of-a-transaction-to-separately/m-p/229698#M68039 <P>It's a very simple search:<BR /> tag=SM | transaction sourcetype Application maxspan=300s</P> Tue, 12 Jan 2016 12:02:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-separate-the-results-of-a-transaction-to-separately/m-p/229698#M68039 gcusello 2016-01-12T12:02:26Z Re: How do I separate the results of a transaction to separately show each event? https://community.splunk.com/t5/Splunk-Search/How-do-I-separate-the-results-of-a-transaction-to-separately/m-p/229699#M68040 <P>Try this:</P> <PRE><CODE>tag=SM | transaction sourcetype Application maxspan=300s mvraw=true | eval myRaw = _raw | mvexpand myRaw | rename myRaw as _raw </CODE></PRE> Tue, 12 Jan 2016 15:28:20 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-separate-the-results-of-a-transaction-to-separately/m-p/229699#M68040 javiergn 2016-01-12T15:28:20Z Re: How do I separate the results of a transaction to separately show each event? https://community.splunk.com/t5/Splunk-Search/How-do-I-separate-the-results-of-a-transaction-to-separately/m-p/229700#M68041 <P>Don't use <CODE>transaction</CODE> in the first place.</P> Wed, 13 Jan 2016 16:24:36 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-separate-the-results-of-a-transaction-to-separately/m-p/229700#M68041 woodcock 2016-01-13T16:24:36Z