Why are we unable to find any results when running the transaction command?

[asm_coe]

Hi,
I have ingested a ticket dump csv file. Transaction ID is one of the fields.

Unable to find any events when I run the transaction commands below.

| transaction Transaction ID
| transaction Transaction ID App ID.

Basically i'm tryoing to build some correlation anong the events. Please help with appropriate transaction commands to overcome this scenario. Thanks.

[niketn]

@asm_code if there is a space in the field name you should put field name in quotes i.e. | transaction "TransactionID". Try the following run anywhere example based on the details provided.

 | makeresults
| eval data="\"Transaction_ID\"=1,status=Incoming;\"Transaction_ID\"=1,status=ACK;\"Transaction_ID\"=1,status=Outgoing;\"Transaction_ID\"=2,status=Incoming;\"Transaction_ID\"=2,status=ACK;"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| extract pairdelim="," kvdelim="="
| rename "Transaction_ID" as "Transaction ID"
| transaction "Transaction ID"
| table _time "Transaction ID"  status duration

However, most of the time using stats to correlate event will perform way better than transaction.