Is there a way to make transaction wait or end before starting new transaction?

[morganj1]

Hi, is there a way to make a Splunk transaction wait until it has ended, before starting another transaction.

e.g. if I have (with latest results at the top)

a	end
b	start
c	start
d	end
e	end
f	start
g	start
h	start

What I get from Splunk here would be transactions: f->e, g->d and b->a.

But what I want is h->e and c->a, so once it's found "start" it then looks for "end", and then looks for the next "start" after that... etc.

[gcusello]

Hi @morganj1,

it's possible if you have a field (e.g. transaction_id) to use as a correlation key to correlate events, if you use startswith and/or endswith options it isn't possible.

Anyway, if you have a field to use as key, see a different approach using the stats command instead transaction because the thansaction command is very slow!

Ciao.

Giuseppe

[PickleRick]

You could also try to transform your data so that it keeps only the first "start" in a row (by using autoregress/streamstats to get previous value and only leave the "start" if it was preceeded by an "end")

[yuanliu]

If you are sure that those 'in-between' events are useless, you can even use dedup to filter them out.