Splunk Search

Transaction function not working with dbquery

ManusMenon
Explorer

Hi All,

I tried using the transaction function on the output of a DB Connect |dbquery and it keeps showing no results.

So my data is like this:

Date      ID Status 
2014/05/12 1 Created
2014/05/12 2 Created
2014/05/12 2 Processing
2014/05/12 1 Processing
2014/05/13 1 Completed
2014/05/13 2 Completed

When I do something like |dbquery <SQL query to get data in above given format>|transaction Status

it returns as no records found.

Kindly provide guidance on this.

Tags (2)
0 Karma

lguinn2
Legend

What do you get if you just do this:

|dbquery <SQL query to get data in above given format>

Plus, it seems strange to me that you would create a transaction based on Status - what are you trying to do?

0 Karma

ManusMenon
Explorer

Hello lguinn,

Thanks you for your reply. The output I gave in the OP is my result set from the SQL query. The transaction should take into account both the ID and the Status. But I tried this in the DB connect app and it still does not work. Is it that the transaction function can only be used in the Search app?

0 Karma
Get Updates on the Splunk Community!

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...