I have a search using the transaction command that returns the following (as a single transaction, not as separate events)...let's call this search "searchA":
2014-04-16 22:40:22,257 MDCID=D325388-5011926287919291836 PerformanceUnitName=eMemberSearch PerformanceUnitDuration=168
2014-04-16 22:40:22,427 MDCID=D325388-5011926287919291836 PerformanceUnitName=eAddTransaction PerformanceUnitDuration=166
2014-04-16 22:40:22,541 MDCID=D325388-5011926287919291836 PerformanceUnitName=eAddTransaction PerformanceUnitDuration=111
2014-04-16 22:40:22,694 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=129
2014-04-16 22:40:22,755 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=58
2014-04-16 22:40:22,829 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=44
2014-04-16 22:40:22,874 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=43
2014-04-16 22:40:22,919 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=42
2014-04-16 22:40:22,997 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=76
2014-04-16 22:40:23,041 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=42
2014-04-16 22:40:23,086 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=42
2014-04-16 22:40:23,258 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=169
When I do searchA | table PerformanceUnitName
, I get the following multivalue field:
eMemberSearch
eAddTransaction
eUpdateCertificate
This is unfortunate, because I actually wanted to count the number of each distinct PerformanceUnitNames in the output.
Is there any way to get the transaction command to preserve the duplicates?
You're looking for mvlist=PerformanceUnitNames
, see http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Transaction for reference.
Yes! It is, in fact.
Use the "mvlist=t" argument to the transaction command.
You're looking for mvlist=PerformanceUnitNames
, see http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Transaction for reference.
The full search command answer for me was:
index="my_app" p_id=* | transaction p_id mvlist=status