Splunk Search

Why are field values lost using the table command after the transaction command?

tenorway
Path Finder

Hi all!

I am using the transaction command to group events based on an identifier occuring in separate indexes. Works nicely. The events shows up with all the information. In the left of the Splunk window, all expected fields from both indexes have values.

However, when trying to display some of the fields using the table command, only the fields from one of the indexes have values. The others are empty.

Piping the output from the transaction command through the fields command fixes the problem, but why is this happening?

Doesn't work (Path is blank):

index=* | rename correlationId as CID | transaction CID | table host, path

Works (Both fields have values):

index=* | rename correlationId as CID | transaction CID | fields * | table host,path

Thanks for any assistance!

0 Karma

wpreston
Motivator

Are your search results set to 'Fast Mode'? If so, Splunk will only extract the fields that it needs (like the default host, source, sourcetype, _time, etc) and the fields that you explicitly state in your search. If you want most or all fields extracted you will need to use either 'Smart Mode' or 'Verbose Mode'.

0 Karma

tenorway
Path Finder

Smart mode

0 Karma

javiergn
Super Champion

Not sure why both searches are not returning the same results but for the sake of performance I would use the following anyway:

index=* 
| rename correlationId as CID
| fields host, path, CID
| stats values(path) as path, values(host) as host by CID
| table host, path

tenorway
Path Finder

Thanks for the reply. The path variable will not be present in all events.
The web will log the path, and the middleware will log other fields.
Will I then be able to display the whole "transaction" in one row using stats?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...