Splunk Search

Get logs with a distinct value of a field


I saw some similar questions but none seem to work

In my splunk logs, I have this field called TransactionID: 6c5802f0-c317-4d3a-9211-2ed7a10a5d7f -> 46314ef3-dac8-4756-902a-76fc61255d11 in my logs
A transaction can have multiple errors but I just want to find how many transactions did error occur in instead of total number of errors.
In other words, I want logs of distinct TransactionID that has error.

I tried index=bc-dag-app AND ERROR | dedup TransactionID but it didn't work.
Can someone please advise?

PS: I am super-new to splunk so I'm sorry if it's a straight forward/stupid question

0 Karma


@ank15july96 First make sure your TransactionID field is being extracted. If it is, then use below query -

index=bc-dag-app AND ERROR | stats dc(TransactionID) as error_count
0 Karma

Path Finder


Actually dedup TransactionID should work if you are looking for distinct transactions.

But if you are looking for all the logs per each transaction, you can try transaction command.

index=bc-dag-app AND ERROR | transaction TransactionID

Hope, it helps.

0 Karma


I tried the above query but it did not yield any result. 😕

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...