Hello i have a problem with searchtxn:
"Error in 'searchtxn' command: This command must be the first command of a search."
and i don't understand how to use it correctly. i have events from one sourcetype and i need to paste them together. They have same number of device "645", but because i have a very long search with rex, i don't know how to paste them. Help me pls how to write correctly searchtxn
The manual is clear. The command Efficiently retrieves transaction events matching the transaction type transaction-name that contain the text selected by search-string.
The example bellow, will Find all email transactions to root from David Smith.
| searchtxn email to=root from="David Smith"
If you still have problems, let me get your query