Problem with grouping events - null value in fields

[rrymaszewski]

There are two events

[mId=x1 timestamp=1396346009255 id=1]

[mId=x2 timestamp=1396346009255]

We are using transaction command to group events by id.

Example of search

mId=x1 OR mId=x2 | transaction id startswith=x1 endswith=x2

There is one result of this search attached below:

[measureId=x1 timestamp=1396346009255 id=1]

[measureId=x2 timestamp=1396346009255]

Could you explain why this two events were grouped ? The id is different for them.

Where I can find description for transaction grouping algorithm?

[MuS]

Hi,

Splunk does not necessarily interpret the transaction defined by multiple fields as a conjunction (field1 AND field2 AND field3) or a disjunction (field1 OR field2 OR field3) of those fields. If there is a transitive relationship between the fields in the fields list, the transaction command will use it.

Take a closer look at these docs about transaction:

http://docs.splunk.com/Documentation/Splunk/6.0.2/Search/Abouttransactions
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchfortransactions
http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Transaction

cheers, MuS