Splunk Search

How do you reference the value of a transaction

adylent
Path Finder

Does anyone know if it is possible to reference the value of a transaction?

For instance

transaction account  startswith="event_type=login" endswith="event_type=logout" 

At this point I should have events encapsulating full user sessions (per account). Can I reference the value of a transaction?

Ideally I'd like to do something like

rex field=transaction mode=sed "s/oldvalue/newvalue/g"  

without have to do this on the _raw prior to the transaction.

Thanks greatly

0 Karma
1 Solution

kristian_kolb
Ultra Champion

After the transaction command, all events that make up the transaction are stored in the _raw field. The old _raw is gone. Of course, events are only changed for the duration of the search - and not changed on disk.

Try it out, just as you wrote it, but remove the field=transaction part.

... | transaction account  startswith="event_type=login" endswith="event_type=logout" 
| rex mode=sed "s/oldvalue/newvalue/g"

/k

View solution in original post

kristian_kolb
Ultra Champion

After the transaction command, all events that make up the transaction are stored in the _raw field. The old _raw is gone. Of course, events are only changed for the duration of the search - and not changed on disk.

Try it out, just as you wrote it, but remove the field=transaction part.

... | transaction account  startswith="event_type=login" endswith="event_type=logout" 
| rex mode=sed "s/oldvalue/newvalue/g"

/k

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...