Splunk Search

Spliting multiple events in a transaction column , into seperate columns

Sp3ctre1
New Member

Hi All,

So when im running a transaction based on starts with .... ends with... i'm getting two events of the transaction which is good, in the same column/row.

So i'm looking to check if when using a transaction we can break out multiple events into multiple columns.. such as the photo below

Example: Top row of third column 2018-06-05T13:41:07.610+1000 is in one row/column separate to 2018-06-05T14:30:49.910+1000

alt text

0 Karma

niketn
Legend

@Sp3ctre1 please add more details, adding your current query used to create transaction would help!
What is the field name of each column that you need including the first one with masked data?

Also add a mock up of the final output you need. Do you need to split each column into two new columns? What would be the column names after you split? Would you split even the first column with data masked?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...