- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How does the searchtxn command work?
Hello i have a problem with searchtxn:
"Error in 'searchtxn' command: This command must be the first command of a search."
and i don't understand how to use it correctly. i have events from one sourcetype and i need to paste them together. They have same number of device "645", but because i have a very long search with rex, i don't know how to paste them. Help me pls how to write correctly searchtxn
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello! Did you read the manual? http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Searchtxn
Take a look at it, and let me know if any issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes i read. and i didn't understand this example.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The manual is clear. The command Efficiently retrieves transaction events matching the transaction type transaction-name that contain the text selected by search-string.
The example bellow, will Find all email transactions to root from David Smith.
| searchtxn email to=root from="David Smith"
If you still have problems, let me get your query
