Getting Data In

How to list all events together of the same time in a nested form?

New Member


I do have logs which has the timestamps and the structure like: Start Perfomance Logging: [txID=123456-SOC98678-SOS87596]:

The log with txID=123456 is stored several times with different timestamps. Like:

6:14:13:784 PM Start Perfomance Logging: [txID=123456-SOC98678-SOS87596], ......
6:14:13:788 PM Start Perfomance Logging: [txID=123456-SOC98678-SOS87596], ......
6:14:13:797 PM End Perfomance Logging: [txID=123456-SOC98678-SOS87596], ......

Now I wish to list all the sub- transactions of txID=123456 occured in different timestamps in a nested form. Also, for a given transaction, I wish to show the rest transaction with the same number in nested form. How could I achieve this?

Thanks in advance for the information.

0 Karma


Take a look at the transaction command.

.. | transaction txID startswith="Start Performance Logging" endswith="End Performance Logging"

More info here

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...