Splunk Search

Transaction displaying multivalued fields alphabetically, not chronologically

responsys_cm
Builder

I'm creating a transaction that is displayed in the following table:

table _time,src_ip,accountname,username,attack,duration,eventcount

The attach field is multivalued. If I just pipe the transaction command to a table, they are displayed in alphabetical order. If I use rex to extract the desired field from the event, it's displayed in the order that the events occurred.

Is it possible to make those values appear chronologically without using rex?

Thx.

C

Tags (1)

jaoui
Path Finder

yep! just figured it out the other day

... | transaction mvlist=t ...

Reference: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

amstaff
Explorer

Yes that is it. Worked for me to.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!