Splunk Search

Transaction startswith argument with named fields ?

Communicator

How can I provide field values to the startswith argument of the transaction command? Like I would do in a search:
index=myindex fieldname=valueToSearchFor

I want to do the same with a transaction

0 Karma

Esteemed Legend

I am not sure I am understanding what you need so this may be way off.

The map command is the only way to template Splunk commands, although it probably was not intended for this.
You can do something like this (assuming fieldname contains the string that you need to use with startswith😞

YourSearchThatGivesMeJustOneEventWithOneFieldWithOneValue | map search "search index=myindex | transaction startswith=\"$fieldname$\""
0 Karma