I am grouping events using the transaction command. Sample search which gives expected results below :
Successful Search:
(index=ind1 OR index=ind2) MachineId=1133 (log_text="*sometext1*" OR log_text="*sometext2*" OR log_text="*sometext3*" OR log_text="*sometext4*" OR log_text="*sometext5*" OR log_text="*sometext6*") | transaction startswith="sometext1" endswith="sometext2" mvlist=true | table _time,log_text
6 log_texts are transactions events.
If I search removing log_text filters, transaction does not work. Sample search below:
Unsuccessful Search:
(index=ind1 OR index=ind2) MachineId=1133 | transaction startswith="sometext1" endswith="sometext2" mvlist=true | table _time,log_text
I am unable to understand this. Can someone please explain?
Try this instead to ensure you are only displaying events where the log_text field has a value:
(index=ind1 OR index=ind2) MachineId=1133 log_text=* | transaction startswith="sometext1" endswith="sometext2" mvlist=true | table _time,log_text
Already tried. This is also not working.
What version of Splunk are you using? There is a bug in 6.3 regarding the transaction command. (SPL-107742) This was resolved in 6.3.2..
I am using Splunk 6.3.0 . So will it work fine in 6.3.2 ?
Upgrade to the latest, it should resolve the issue.
Ok. I'll try that.
Upgrading didn't worked .. Still not getting results. Now using splunk 6.3.2 . Any other suggestion ? or any other possibility or reason, why its not working ..
OK, without knowing what sometext is I would try the following and see if that works:
(index=ind1 OR index=ind2) MachineId=1133 log_text=*
| fields _time, log_text
| transaction startswith=eval(match(log_text, "sometext1")) endswith=eval(match(log_text, "sometext2")) mvlist=true
| table _time, log_text
Note the difference in the startswith and endswith filters.