Transaction with multiple sourcetype

[cafissimo]

Hello, please, I would like to know if it is possible to use multiple and different sourcetypes with the splunk "transaction" command.

Thanks and kind regards.

Luca Caldiero Consoft Sistemi S.p.A.

[ziegfried]

What the transaction command does is simply grouping/merging events with the same value of the specified field(s) into one event. sourcetype is just another field for this command. So a simple search like this would create transaction events from multiple sourcetypes:

sourcetype=my_sourcetype1 OR sourcetype=mysourcetype2 | transaction myTransactionField

The only thing that matters is that the content of the field(s) used to build the transaction has the same value in those events that should get merged.

[cafissimo]

Thanks to both of you.

[LCM · Accepted solution]

I guess it's similar to this one: http://answers.splunk.com/questions/3994/multiple-transactions-in-a-single-search

gkanapathy mentioned several sourcetypes with one transaction command