How to use transaction

[john]

Hi,

User want to see 100 events after a particular event or String eg Id=987.
I have used transaction for that.But after 30 events "Id=987" is appearing again in logs so splunk breaks the events.So that only 30 records are able to clump.

This is the query iam using.
index="" source="" | transaction maxevents=300 startswith="Id=987"| search 987|sort _time

What i am looking for is transaction should strats with first occurence of id and it should group all next 100 0r 200 records irresptive of breaking on next occurence of id.Please help

[davecroto]

startswith and endswith:

startswith=

A search or eval-filtering expression which, if satisfied by an event, marks the beginning of a new transaction.
For example:
    startswith="login"
    startswith=(username=foobar)
    startswith=eval(speed_field < max_speed_field)
    startswith=eval(speed_field < max_speed_field/12) 
Defaults to "". 

endswith=

A search or eval-filtering expression which, if satisfied by an event, marks the end of a transaction.
For example:
    endswith="logout"
    endswith=(username=foobar)
    endswith=eval(speed_field < max_speed_field)
    endswith=eval(speed_field < max_speed_field/12) 
Defaults to "". 

[sdaniels]

Does each of the 100 events you want to look at have the 'Id=987'? If so, you should have a field called 'Id' and then you'd do this:

 ... | transaction Id maxevents=100 

This will created a transaction of all events witha given Id and show you 100 of them. By default the maximum number of events in a transaction is 1000.

Look at example 4 in the docs. This shows multiple ids that are being correlated for a transaction but you'll get the idea by looking at the raw events below the example.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transaction