Splunk Search

Convert Transaction Search

bah5663_98
Explorer

I made the following search to group exceptions together that happened within 1 second but I want to be able to view the source and make the search more efficient. Is there a search that will yield the same results without using the transaction command?

index=java_logs Exception | transaction maxspan=1s

0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, try this:

index=java_logs Exception | bin _time span=1s | stats list(_raw) AS events values(source) AS sources BY _time

View solution in original post

woodcock
Esteemed Legend

Yes, try this:

index=java_logs Exception | bin _time span=1s | stats list(_raw) AS events values(source) AS sources BY _time

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try index=java_logs Exception | bin span=1s _time | stats values(*) as * by _time

---
If this reply helps you, an upvote would be appreciated.
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!