Does the "Show Source" Event Actions link not work in results after using a "transaction" command in a search?

[michael_schmidt]

Leave it to the DEV guys to find the weirdest errors...but here's the deal.

I've got a developer who needs to see his events in context, hence the use of the Show Source button. Except that he's using a Transaction command in his search, so that it "gloms" multiple events together and displays it as one log entry in the search output. Then when trying to Show Source, the Results window is balking at showing the source and kicks back:

Error in 'surrounding' command: Invalid argument: '3160:101421'
No search results for surrounding search where targetId=3160:101411 3160:101421 3160:101429 3160:101505

I assume that this is due to the fact that he's trying to show the source of an "event" that's actually a combination of multiple events and the back end programming doesn't allow for that, since how would it know which event to show in the combination.

I assume that this is the equivalent of the old man from scene 24 being asked "African or European Swallow?" and replying "I don't know that!" and being tossed into the Gorge of Eternal Peril, but I thought maybe somebody would like to know that this possibility exists, and that perhaps it should show something more like:

Source cannot be shown for Multiple Events.  (Error:5-No-3-Sir)

Has anyone else ever come up against this situation, and am I correct in my interpretation?

And I really want there to be an (Error:5-No-3-Sir) error code in a future release...

[woodcock]

You are correct and this one more reason NOT to use transaction. Try something like this instead:

.... | stats list(_raw) AS events range(_time) AS duration BY host