Splunk Enterprise

Transaction command not working

shashank_24
Path Finder

Hi, I am trying to use transaction command where I need to get the data from 2 specific events with different sourcetypes. These 2 events are 

 

 

2020-07-09 12:50:09,918 id="id:1234" event=test_attempt app= connid=myapp status=inprogress responsetime=7 inmessagetype="Request"

2020-07-09 12:50:09,105 id:1234 INFO  [org.test.validator.MediaValidator] in MediaValidator VERIFIED user=test@gmail.com found and match

 

 

The 1st event could occur multiple times in the same transaction and that's why sometimes my transaction command is just grouping those 2 events and that's it.
The common attribute in both of these events are id on which I am using transaction like below but it doesn't seem to be working.

Sometimes I am only getting single event and sometimes the 1st event is grouped together 

Can someone advice what could be done here to achieve this task. I can't use join because of the subsearch limitation and I have to use the transaction.

 

 

index=myindex (sourcetype="server_log" "[org.test.validator.MediaValidator] in MediaValidator) OR (source="/app/log/splunk-audit.log" event=test_attempt inmessagetype="Request" sourcetype=audit_log)
| rex field=_raw "id\=\"id\:(?<id>[^\"]+)"
| rex field=_raw "id\:(?<id>[^\s]+)"
| transaction id keepevicted=true

 

 

 @gcusello @to4kawa 

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Instead of transaction, try stats

| stats values(*) as * by id

.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Instead of transaction, try stats

| stats values(*) as * by id

.

 

---
If this reply helps you, Karma would be appreciated.

shashank_24
Path Finder

@richgalloway Thanks for the response. I knew this solution with stats but I was trying to understand why transaction is not working. Anyways I was able to achieve with stats so i will accept the answer.

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...