Splunk Search

How to use transaction command with message and as argument?

abhi04
Path Finder

How to use message name as argument for transaction command? I have logs relate to a particular message ID for one source type or an app say A but don't see any logs for the same message ID in another source type or app say B but when login to the server of app B,can see the logs related to app B.

Tags (1)
0 Karma

bangalorep
Communicator

Hello!
You could use something like this

| transaction message_id

Let me know if this works

0 Karma

p_gurav
Champion

Can you provide some sample data?

0 Karma

abhi04
Path Finder

Sorry, I can't .

0 Karma

p_gurav
Champion

You can pass field name while doing transaction. Refer below doc :
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction#Extended_Examples

ALso if data is not coming from app_B, can you run below command on server of appB:

.\splunk list monitor

And check data is being monitored or not?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!