Splunk Search

How to use Transaction command with two extracted join fields?

jbrenner
Path Finder

I have two Splunk queries, each of which uses the _rex command to extract the join field.

Example:

 

 

 

QUERY 1
index=index1 "Query1" | rex field=_raw "abc(?<MY_JOIN_FIELD>def)"

QUERY 2
index=index2 "Query2" | rex field=_raw "ghi(?<MY_JOIN_FIELD>jkl)"

 

 

 

I want to use the Transaction command to correlate these two queries, but I can't figure out how to do it.

Thanks!

Jonathan

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jbrenner ,

you should try something like this:

index=index1  
| rex field=_raw "abc(?<MY_JOIN_FIELD>def)"
| append [ search 
     index=index2 
     | rex field=_raw "ghi(?<MY_JOIN_FIELD>jkl)"
     ]
| transaction <MY_JOIN_FIELD>
| ...

otherwise, you could extract both the MY_JOIN_FIELD before so you don't need to extract them in the search, in other words:

index=index1 OR index=index2
| transaction <MY_JOIN_FIELD>
| ...

But i invite you to think in a different way:

At first extract the two fields before and then try to use stats command instead of transaction:

index=index1 OR index=index2
| stats values(field1) AS field1 values(field2) AS field2 values(field3) AS field3 BY <MY_JOIN_FIELD>

where field1, field2 and field3 are the fields you need in your events.

This solution is very much performant than using transaction.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @jbrenner ,

you should try something like this:

index=index1  
| rex field=_raw "abc(?<MY_JOIN_FIELD>def)"
| append [ search 
     index=index2 
     | rex field=_raw "ghi(?<MY_JOIN_FIELD>jkl)"
     ]
| transaction <MY_JOIN_FIELD>
| ...

otherwise, you could extract both the MY_JOIN_FIELD before so you don't need to extract them in the search, in other words:

index=index1 OR index=index2
| transaction <MY_JOIN_FIELD>
| ...

But i invite you to think in a different way:

At first extract the two fields before and then try to use stats command instead of transaction:

index=index1 OR index=index2
| stats values(field1) AS field1 values(field2) AS field2 values(field3) AS field3 BY <MY_JOIN_FIELD>

where field1, field2 and field3 are the fields you need in your events.

This solution is very much performant than using transaction.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @jbrenner,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

jbrenner
Path Finder

@gcusello Thanks Giuseppe! Worked like a charm! I originally considered your alternative solution, but this is a one-off scenario, and it's unlikely we will ever use these extracted fields again.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...