Splunk Enterprise

Transaction command not working

shashank_24
Path Finder

Hi, I am trying to use transaction command where I need to get the data from 2 specific events with different sourcetypes. These 2 events are 

 

 

2020-07-09 12:50:09,918 id="id:1234" event=test_attempt app= connid=myapp status=inprogress responsetime=7 inmessagetype="Request"

2020-07-09 12:50:09,105 id:1234 INFO  [org.test.validator.MediaValidator] in MediaValidator VERIFIED user=test@gmail.com found and match

 

 

The 1st event could occur multiple times in the same transaction and that's why sometimes my transaction command is just grouping those 2 events and that's it.
The common attribute in both of these events are id on which I am using transaction like below but it doesn't seem to be working.

Sometimes I am only getting single event and sometimes the 1st event is grouped together 

Can someone advice what could be done here to achieve this task. I can't use join because of the subsearch limitation and I have to use the transaction.

 

 

index=myindex (sourcetype="server_log" "[org.test.validator.MediaValidator] in MediaValidator) OR (source="/app/log/splunk-audit.log" event=test_attempt inmessagetype="Request" sourcetype=audit_log)
| rex field=_raw "id\=\"id\:(?<id>[^\"]+)"
| rex field=_raw "id\:(?<id>[^\s]+)"
| transaction id keepevicted=true

 

 

 @gcusello @to4kawa 

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Instead of transaction, try stats

| stats values(*) as * by id

.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Instead of transaction, try stats

| stats values(*) as * by id

.

 

---
If this reply helps you, Karma would be appreciated.

shashank_24
Path Finder

@richgalloway Thanks for the response. I knew this solution with stats but I was trying to understand why transaction is not working. Anyways I was able to achieve with stats so i will accept the answer.

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...