https://community.splunk.com/t5/Splunk-Search/Transactions-based-on-distinct-values-of-extracted-field/m-p/295105#M89065 <P>Try like this</P> <PRE><CODE>some_id | transaction session_id startswith="Session closed" endswith="Session opened" maxpause=30m | stats count as connection_breaks by session_id </CODE></PRE> Tue, 16 May 2017 18:22:25 GMT somesoni2 2017-05-16T18:22:25Z https://community.splunk.com/t5/Splunk-Search/Transactions-based-on-distinct-values-of-extracted-field/m-p/295104#M89064 <P>Hi,</P> <P>I'm trying to create transactions from events like this:</P> <P><CODE>Session opened: [some id]</CODE></P> <P><CODE>Session closed: [some id]</CODE></P> <P>For a single id I can just use a search like this:<BR /><BR /> <CODE>some_id | transaction startswith="Session closed" endswith="Session opened" maxpause=30m</CODE><BR /> to find sessions that had a break of at most 30 minutes.</P> <P>The <CODE>session_id</CODE> I'm searching with is an extracted field. How would I go about finding the count of these transactions (closed -&gt; opened) per <CODE>session_id</CODE>?</P> <P>This is what I would like to get out:</P> <PRE><CODE>session connection_breaks ----------------------------------- session1 1 session2 5 session3 2 </CODE></PRE> Tue, 16 May 2017 09:07:08 GMT https://community.splunk.com/t5/Splunk-Search/Transactions-based-on-distinct-values-of-extracted-field/m-p/295104#M89064 mjuopperi_elisa 2017-05-16T09:07:08Z https://community.splunk.com/t5/Splunk-Search/Transactions-based-on-distinct-values-of-extracted-field/m-p/295105#M89065 <P>Try like this</P> <PRE><CODE>some_id | transaction session_id startswith="Session closed" endswith="Session opened" maxpause=30m | stats count as connection_breaks by session_id </CODE></PRE> Tue, 16 May 2017 18:22:25 GMT https://community.splunk.com/t5/Splunk-Search/Transactions-based-on-distinct-values-of-extracted-field/m-p/295105#M89065 somesoni2 2017-05-16T18:22:25Z