Getting Data In

Multiple Transactions in a Single Search

I am trying to link events from two separate sourcetypes together that have different fields available. The "corps_app_error" sourcetype only has ReqId available, while the "corps_app_audit" sourcetype has both ReqId and trackerid. I want all events with the same trackerid or ReqId to become a single transaction. I then want to find all transactions with both sourcetypes within them (To find which transactions had errors essentially).

However, when I do a search with two "transaction" strings the results go blank. An OR within the transaction doesn't appear to give me the results I'm after as well.

sourcetype="corps_app_error" OR (sourcetype="corps_app_audit" operation=CreatePIN ref_operation=CreatePIN step=Resolve) | transaction keepevicted=true ReqId | transaction keepevicted=true trackerid | search sourcetype="corps_app_audit" AND sourcetype="corps_app_error"

Any suggestions?

The first answer doesn't seem to work for me. If I do the search:

sourcetype="corps_app_error" OR (sourcetype="corps_app_audit" operation=CreatePIN step=Resolve method=NBPart OR method=RtlCust OR method=eWPEmp begin) | transaction keepevicted=true ReqId | search sourcetype="corps_app_audit" AND sourcetype="corps_app_error" trackerid="4c24c2810a060c7c20005f3a0016aa33" | transaction keepevicted=true trackerid

I get 1 result and it tells me 1 event showing yet I can't see any events listed. Basically the events pane is blank.

While if I do the search:

sourcetype="corps_app_error" OR (sourcetype="corps_app_audit" operation=CreatePIN step=Resolve method=NBPart OR method=RtlCust OR method=eWPEmp begin) | transaction keepevicted=true ReqId trackerid | search sourcetype="corps_app_audit" AND sourcetype="corps_app_error" trackerid="4c24c2810a060c7c20005f3a0016aa33"

I get 9 results and the trackerid's are not combined into a single transaction like I expect them to be.

1 Solution

Splunk Employee
Splunk Employee

You should be able to just use a single transaction command: ...|transaction ReqId trackerid | search sourcetype="corps_app_audit" AND sourcetype="corps_app_error"

If an event is missing a transaction field (trackerid), but matches on others (ReqId), it will still be included in the transaction.

View solution in original post

Splunk Employee
Splunk Employee

You should be able to just use a single transaction command: ...|transaction ReqId trackerid | search sourcetype="corps_app_audit" AND sourcetype="corps_app_error"

If an event is missing a transaction field (trackerid), but matches on others (ReqId), it will still be included in the transaction.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!