How to capture the transations of an event

[joshy_m]

Hi,

I am pretty much new to Splunk and was exploring various options. There is a specific case in our project where in we need to capture a transation completely. The transaction can be identifed by a start string and an end string
e.g
Started the Event 123456
XXXX
YYY
ZZZ
AAAA
BBBB
Completed the event 123456

The above example illustrates the specific set of activity by an event and the only identifier to capture the event is the ID and I want all the log traces between those two lines(start and completed).

Can we do this using Splunk? If so, can I get some tips on this?
I did some work by searching the strings, ids etc but all I can get, was just the line not the entire transaction from that event.

Appreciate any help

[joshy_m]

Thx Kristian and wpreston for your answers. Transaction surely helps me ..

[joshy_m]

Thx Kristian and wpreston for your answers. Transaction surely helps me ..

[wpreston]

I agree with kristian.kolb, some anonymized sample events would be helpful as there are many different options when creating transactions.

[joshy_m]

Thank you. It helped

[kristian_kolb · Accepted solution]

There is a command called transaction, which will operate with specific start/stop indicators, like you have outlined.

If you have a common transaction-id in each event of the transaction, you can also use that to 'group by' so-to-speak.

Best of all is that you update your question with a couple of sample events, as it's much easier to advise you then.

/Kristian

[joshy_m]

Thx Kristian.. It helped