Splunk Search

Spliting multiple events in a transaction column , into seperate columns

Sp3ctre1
New Member

Hi All,

So when im running a transaction based on starts with .... ends with... i'm getting two events of the transaction which is good, in the same column/row.

So i'm looking to check if when using a transaction we can break out multiple events into multiple columns.. such as the photo below

Example: Top row of third column 2018-06-05T13:41:07.610+1000 is in one row/column separate to 2018-06-05T14:30:49.910+1000

alt text

0 Karma

niketn
Legend

@Sp3ctre1 please add more details, adding your current query used to create transaction would help!
What is the field name of each column that you need including the first one with masked data?

Also add a mock up of the final output you need. Do you need to split each column into two new columns? What would be the column names after you split? Would you split even the first column with data masked?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...