How to list all events together of the same time in a nested form?

[rakeshkumar_sah]

Hi

I do have logs which has the timestamps and the structure like: Start Perfomance Logging: [txID=123456-SOC98678-SOS87596]:

The log with txID=123456 is stored several times with different timestamps. Like:

6:14:13:784 PM Start Perfomance Logging: [txID=123456-SOC98678-SOS87596], ......
6:14:13:788 PM Start Perfomance Logging: [txID=123456-SOC98678-SOS87596], ......
6:14:13:797 PM End Perfomance Logging: [txID=123456-SOC98678-SOS87596], ......

Now I wish to list all the sub- transactions of txID=123456 occured in different timestamps in a nested form. Also, for a given transaction, I wish to show the rest transaction with the same number in nested form. How could I achieve this?

Thanks in advance for the information.

[sundareshr]

Take a look at the transaction command.

.. | transaction txID startswith="Start Performance Logging" endswith="End Performance Logging"

More info here http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Transaction