Splunk Enterprise

Transaction command not working

shashank_24
Path Finder

Hi, I am trying to use transaction command where I need to get the data from 2 specific events with different sourcetypes. These 2 events are 

 

 

2020-07-09 12:50:09,918 id="id:1234" event=test_attempt app= connid=myapp status=inprogress responsetime=7 inmessagetype="Request"

2020-07-09 12:50:09,105 id:1234 INFO  [org.test.validator.MediaValidator] in MediaValidator VERIFIED user=test@gmail.com found and match

 

 

The 1st event could occur multiple times in the same transaction and that's why sometimes my transaction command is just grouping those 2 events and that's it.
The common attribute in both of these events are id on which I am using transaction like below but it doesn't seem to be working.

Sometimes I am only getting single event and sometimes the 1st event is grouped together 

Can someone advice what could be done here to achieve this task. I can't use join because of the subsearch limitation and I have to use the transaction.

 

 

index=myindex (sourcetype="server_log" "[org.test.validator.MediaValidator] in MediaValidator) OR (source="/app/log/splunk-audit.log" event=test_attempt inmessagetype="Request" sourcetype=audit_log)
| rex field=_raw "id\=\"id\:(?<id>[^\"]+)"
| rex field=_raw "id\:(?<id>[^\s]+)"
| transaction id keepevicted=true

 

 

 @gcusello @to4kawa 

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Instead of transaction, try stats

| stats values(*) as * by id

.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Instead of transaction, try stats

| stats values(*) as * by id

.

 

---
If this reply helps you, Karma would be appreciated.

shashank_24
Path Finder

@richgalloway Thanks for the response. I knew this solution with stats but I was trying to understand why transaction is not working. Anyways I was able to achieve with stats so i will accept the answer.

0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...