How does the searchtxn command work?

[kozhin]

Hello i have a problem with searchtxn:

"Error in 'searchtxn' command: This command must be the first command of a search."

and i don't understand how to use it correctly. i have events from one sourcetype and i need to paste them together. They have same number of device "645", but because i have a very long search with rex, i don't know how to paste them. Help me pls how to write correctly searchtxn

[stephanefotso]

Hello! Did you read the manual? http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Searchtxn
Take a look at it, and let me know if any issue.

[kozhin]

yes i read. and i didn't understand this example.

[stephanefotso]

The manual is clear. The command Efficiently retrieves transaction events matching the transaction type transaction-name that contain the text selected by search-string.
The example bellow, will Find all email transactions to root from David Smith.

| searchtxn email to=root from="David Smith"

If you still have problems, let me get your query