How to use message name as argument for transaction command? I have logs relate to a particular message ID for one source type or an app say A but don't see any logs for the same message ID in another source type or app say B but when login to the server of app B,can see the logs related to app B.
Hello!
You could use something like this
| transaction message_id
Let me know if this works
Can you provide some sample data?
Sorry, I can't .
You can pass field name while doing transaction. Refer below doc :
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction#Extended_Examples
ALso if data is not coming from app_B, can you run below command on server of appB:
.\splunk list monitor
And check data is being monitored or not?