Splunk Search

How to use Transaction command with two extracted join fields?

jbrenner
Path Finder

I have two Splunk queries, each of which uses the _rex command to extract the join field.

Example:

 

 

 

QUERY 1
index=index1 "Query1" | rex field=_raw "abc(?<MY_JOIN_FIELD>def)"

QUERY 2
index=index2 "Query2" | rex field=_raw "ghi(?<MY_JOIN_FIELD>jkl)"

 

 

 

I want to use the Transaction command to correlate these two queries, but I can't figure out how to do it.

Thanks!

Jonathan

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jbrenner ,

you should try something like this:

index=index1  
| rex field=_raw "abc(?<MY_JOIN_FIELD>def)"
| append [ search 
     index=index2 
     | rex field=_raw "ghi(?<MY_JOIN_FIELD>jkl)"
     ]
| transaction <MY_JOIN_FIELD>
| ...

otherwise, you could extract both the MY_JOIN_FIELD before so you don't need to extract them in the search, in other words:

index=index1 OR index=index2
| transaction <MY_JOIN_FIELD>
| ...

But i invite you to think in a different way:

At first extract the two fields before and then try to use stats command instead of transaction:

index=index1 OR index=index2
| stats values(field1) AS field1 values(field2) AS field2 values(field3) AS field3 BY <MY_JOIN_FIELD>

where field1, field2 and field3 are the fields you need in your events.

This solution is very much performant than using transaction.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @jbrenner ,

you should try something like this:

index=index1  
| rex field=_raw "abc(?<MY_JOIN_FIELD>def)"
| append [ search 
     index=index2 
     | rex field=_raw "ghi(?<MY_JOIN_FIELD>jkl)"
     ]
| transaction <MY_JOIN_FIELD>
| ...

otherwise, you could extract both the MY_JOIN_FIELD before so you don't need to extract them in the search, in other words:

index=index1 OR index=index2
| transaction <MY_JOIN_FIELD>
| ...

But i invite you to think in a different way:

At first extract the two fields before and then try to use stats command instead of transaction:

index=index1 OR index=index2
| stats values(field1) AS field1 values(field2) AS field2 values(field3) AS field3 BY <MY_JOIN_FIELD>

where field1, field2 and field3 are the fields you need in your events.

This solution is very much performant than using transaction.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @jbrenner,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

jbrenner
Path Finder

@gcusello Thanks Giuseppe! Worked like a charm! I originally considered your alternative solution, but this is a one-off scenario, and it's unlikely we will ever use these extracted fields again.

0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...