There are two events
[mId=x1 timestamp=1396346009255 id=1]
[mId=x2 timestamp=1396346009255]
We are using transaction command to group events by id.
Example of search
mId=x1 OR mId=x2 | transaction id startswith=x1 endswith=x2
There is one result of this search attached below:
[measureId=x1 timestamp=1396346009255 id=1]
[measureId=x2 timestamp=1396346009255]
Could you explain why this two events were grouped ? The id is different for them.
Where I can find description for transaction grouping algorithm?
Hi,
Splunk does not necessarily interpret the transaction defined by multiple fields as a conjunction (field1 AND field2 AND field3) or a disjunction (field1 OR field2 OR field3) of those fields. If there is a transitive relationship between the fields in the fields list, the transaction command will use it.
Take a closer look at these docs about transaction:
http://docs.splunk.com/Documentation/Splunk/6.0.2/Search/Abouttransactions
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchfortransactions
http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Transaction
cheers, MuS