Splunk Search

Transaction displaying multivalued fields alphabetically, not chronologically

responsys_cm
Builder

I'm creating a transaction that is displayed in the following table:

table _time,src_ip,accountname,username,attack,duration,eventcount

The attach field is multivalued. If I just pipe the transaction command to a table, they are displayed in alphabetical order. If I use rex to extract the desired field from the event, it's displayed in the order that the events occurred.

Is it possible to make those values appear chronologically without using rex?

Thx.

C

Tags (1)

jaoui
Path Finder

yep! just figured it out the other day

... | transaction mvlist=t ...

Reference: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

amstaff
Explorer

Yes that is it. Worked for me to.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...