Splunk Search

Transactions and reporting multivalue event types

New Member

Hi all. I'm having trouble expanding a multivalued Transaction into separate fields by their corresponding values. I'm conducting a quality study to determine the number of incomplete first inspections. For example, inspector "a" initially approved a product, but when the product was returned for further service inspector "b" discovered issues that should've been captured originally. I've tried using the stats command to accomplish this, but the results were unreliable from a sequence of events perspective, so I've decided to use the transaction command which has yielded much better results.

What I would like to do is to keep the transaction grouped by productId, but separate eventTypes values by inspectorName, so I can create reporting.

This is queuery I'm trying to expand:

| transaction productId startswith=(eventType=approve AND new=true OR new=false) endswith=(eventType=reject AND new=true) mvlist=true

I've tried combining fields with mvzip, but it's hard for me to manipulate the data to create a nice tabular report.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!