Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Transaction on eval field
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it possible to create a transaction on an eval field after passing through stats?
... | stats sum(total) as total sum(units) as units by AccountID Action Item | transaction mvlist=t AccountID
AccountID is a field created by an extractor, when I try run the transaction after stats, I get no results. There are a handful of eval's prior to the stats command.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From the transaction page in the search reference:
Given events as input, finds transactions based on events that meet various constraints. Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member.
When you've run stats, there is no longer a _raw field for transaction to use.
Your search looks kind of weird - what do you want to use transaction on your stats results for?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From the transaction page in the search reference:
Given events as input, finds transactions based on events that meet various constraints. Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member.
When you've run stats, there is no longer a _raw field for transaction to use.
Your search looks kind of weird - what do you want to use transaction on your stats results for?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah, I was thinking something along those lines 🙂
Good that you got it working!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
purely for report layout purposes. I want the left column to have the AccountID (once) and then the next column to list the items. When using a transaction, i can display multiple fields. I guess I could use something like the stats list function.
Edit
Have just tested and list works perfectly:
... | stats list(Item) as Item list(units) as Units list(total) as Total by AccountID Action
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
