Splunk Search

Spliting multiple events in a transaction column , into seperate columns

Sp3ctre1
New Member

Hi All,

So when im running a transaction based on starts with .... ends with... i'm getting two events of the transaction which is good, in the same column/row.

So i'm looking to check if when using a transaction we can break out multiple events into multiple columns.. such as the photo below

Example: Top row of third column 2018-06-05T13:41:07.610+1000 is in one row/column separate to 2018-06-05T14:30:49.910+1000

alt text

0 Karma

niketn
Legend

@Sp3ctre1 please add more details, adding your current query used to create transaction would help!
What is the field name of each column that you need including the first one with masked data?

Also add a mock up of the final output you need. Do you need to split each column into two new columns? What would be the column names after you split? Would you split even the first column with data masked?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...