Splunk Search

Using the transaction command, why are events from the same directory not collated when they took place at the same time?

sameeripro
Path Finder

I am using the transaction command, but the events are not collated when they took place at the same time and directory

eventtype=ossec integrity HKEY NOT tag::eventtype=noise | transaction reporting_host,file_dirname 

alt text

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

It looks like you have bad line-breaking.. If this is the case, then you should fix it at the index level compared to using a transaction command at the search level to maximize performance. Is the current line-breaking correct?

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...