Transaction on eval field

[brettcave]

Is it possible to create a transaction on an eval field after passing through stats?

... | stats sum(total) as total sum(units) as units by AccountID Action Item | transaction mvlist=t AccountID 

AccountID is a field created by an extractor, when I try run the transaction after stats, I get no results. There are a handful of eval's prior to the stats command.

[Ayn · Accepted solution]

From the transaction page in the search reference:

Given events as input, finds transactions based on events that meet various constraints. Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member. 

When you've run stats, there is no longer a _raw field for transaction to use.

Your search looks kind of weird - what do you want to use transaction on your stats results for?

[Ayn]

Yeah, I was thinking something along those lines 🙂

Good that you got it working!

[brettcave]

purely for report layout purposes. I want the left column to have the AccountID (once) and then the next column to list the items. When using a transaction, i can display multiple fields. I guess I could use something like the stats list function.

Edit
Have just tested and list works perfectly:

... | stats list(Item) as Item list(units) as Units list(total) as Total by AccountID Action