Why are field values lost using the table command after the transaction command?

[tenorway]

Hi all!

I am using the transaction command to group events based on an identifier occuring in separate indexes. Works nicely. The events shows up with all the information. In the left of the Splunk window, all expected fields from both indexes have values.

However, when trying to display some of the fields using the table command, only the fields from one of the indexes have values. The others are empty.

Piping the output from the transaction command through the fields command fixes the problem, but why is this happening?

Doesn't work (Path is blank):

index=* | rename correlationId as CID | transaction CID | table host, path

Works (Both fields have values):

index=* | rename correlationId as CID | transaction CID | fields * | table host,path

Thanks for any assistance!

[wpreston]

Are your search results set to 'Fast Mode'? If so, Splunk will only extract the fields that it needs (like the default host, source, sourcetype, _time, etc) and the fields that you explicitly state in your search. If you want most or all fields extracted you will need to use either 'Smart Mode' or 'Verbose Mode'.

[tenorway]

Smart mode

[javiergn]

Not sure why both searches are not returning the same results but for the sake of performance I would use the following anyway:

index=* 
| rename correlationId as CID
| fields host, path, CID
| stats values(path) as path, values(host) as host by CID
| table host, path

[tenorway]

Thanks for the reply. The path variable will not be present in all events.
The web will log the path, and the middleware will log other fields.
Will I then be able to display the whole "transaction" in one row using stats?