I saw some similar questions but none seem to work
In my splunk logs, I have this field called TransactionID: 6c5802f0-c317-4d3a-9211-2ed7a10a5d7f -> 46314ef3-dac8-4756-902a-76fc61255d11 in my logs
A transaction can have multiple errors but I just want to find how many transactions did error occur in instead of total number of errors.
In other words, I want logs of distinct TransactionID that has error.
I tried index=bc-dag-app AND ERROR | dedup TransactionID but it didn't work.
Can someone please advise?
PS: I am super-new to splunk so I'm sorry if it's a straight forward/stupid question