Using "transaction" Command

[daniaabujuma]

Hello Splunkers!

I am using "transaction" command to merge multiple logs based on a mutual field between them. To clarify, I have email logs, the issue is that for 1 email I receive 4 logs in the following order:

1. from
2. subject
3. attachment
4. to

They all have one field in common: id.

I am using the following transaction command: 

| transaction id startswith=from endswith=to 

 The issue is that it merges only the two logs containing "from" and "to".

Can you please verify if I am using the command correctly because I need it to also merge the logs in between not only "from" and "to".

[richgalloway]

The transaction command is inefficient.  Consider using the stats command to group events together by id.

| stats values(*) as * by id

[daniaabujuma]

Hello @richgalloway ,

Thank you for your reply!

I tried your recommendation but unfortunately it didn't work. Do you have any other suggestions?

[richgalloway]

Please explain what you mean by "it didn't work".  What results did you get and how do they compare to the expected results?

Please share sample sanitized events and the desired output.