topic Transaction missing fields in Splunk Search

Transaction missing fields

ericrobinson — Thu, 27 Jan 2011 01:16:44 GMT

I have a search defining a Transaction across (2) different log files. The problem is that some fields (not all) are missing in the results when using the transaction command. When I search for the events in the individual logs, the fields are present. Any ideas? These are all FIELD=VALUE.

Re: Transaction missing fields

jrodman — Thu, 27 Jan 2011 15:11:16 GMT

Are they still missing if you use |fields and specify that field? (I'd guess yes, but don't know.)

Re: Transaction missing fields

Jason — Thu, 24 Mar 2011 23:00:03 GMT

I am noticing this problem too. When I search for the first event in my transaction, I see 100% of them with the dest field. When I transact them together with a few nearby log entries that do not have dest fields, ... SOME transactions have dest, some do not.

Re: Transaction missing fields

woodcock — Wed, 27 May 2015 05:46:18 GMT

Are you using startswith and endswith? If so you might be evicting unclosed transactions so add keepevicted=t.

Re: Transaction missing fields

ccdeflon — Fri, 09 Mar 2018 09:59:52 GMT

I ran in to the same issue, and after unsuccessfully trying to wrap my head around why Splunk sometimes "forgets" some of its field extractions when transaction is used I reverted to just rex extracting them from _raw after transaction and joined them. Not the prettiest of solutions, but it was the only way I was getting it to work.