topic Re: Why are field values lost using the table command after the transaction command? in Splunk Search

Why are field values lost using the table command after the transaction command?

tenorway — Thu, 21 Jan 2016 08:04:31 GMT

Hi all!

I am using the transaction command to group events based on an identifier occuring in separate indexes. Works nicely. The events shows up with all the information. In the left of the Splunk window, all expected fields from both indexes have values.

However, when trying to display some of the fields using the table command, only the fields from one of the indexes have values. The others are empty.

Piping the output from the transaction command through the fields command fixes the problem, but why is this happening?

Doesn't work (Path is blank):

index=* | rename correlationId as CID | transaction CID | table host, path

Works (Both fields have values):

index=* | rename correlationId as CID | transaction CID | fields * | table host,path

Thanks for any assistance!

Re: Why are field values lost using the table command after the transaction command?

javiergn — Thu, 21 Jan 2016 09:54:28 GMT

Not sure why both searches are not returning the same results but for the sake of performance I would use the following anyway:

index=* 
| rename correlationId as CID
| fields host, path, CID
| stats values(path) as path, values(host) as host by CID
| table host, path

Re: Why are field values lost using the table command after the transaction command?

wpreston — Thu, 21 Jan 2016 14:05:57 GMT

Are your search results set to 'Fast Mode'? If so, Splunk will only extract the fields that it needs (like the default host, source, sourcetype, _time, etc) and the fields that you explicitly state in your search. If you want most or all fields extracted you will need to use either 'Smart Mode' or 'Verbose Mode'.

Re: Why are field values lost using the table command after the transaction command?

tenorway — Fri, 22 Jan 2016 06:57:24 GMT

Thanks for the reply. The path variable will not be present in all events.
The web will log the path, and the middleware will log other fields.
Will I then be able to display the whole "transaction" in one row using stats?

Re: Why are field values lost using the table command after the transaction command?

tenorway — Fri, 22 Jan 2016 06:57:57 GMT

Smart mode