Splunk Search

Why are we unable to find any results when running the transaction command?


I have ingested a ticket dump csv file. Transaction ID is one of the fields.

Unable to find any events when I run the transaction commands below.

| transaction Transaction ID
| transaction Transaction ID App ID.

Basically i'm tryoing to build some correlation anong the events. Please help with appropriate transaction commands to overcome this scenario. Thanks.

0 Karma


@asm_code if there is a space in the field name you should put field name in quotes i.e. | transaction "TransactionID". Try the following run anywhere example based on the details provided.

 | makeresults
| eval data="\"Transaction_ID\"=1,status=Incoming;\"Transaction_ID\"=1,status=ACK;\"Transaction_ID\"=1,status=Outgoing;\"Transaction_ID\"=2,status=Incoming;\"Transaction_ID\"=2,status=ACK;"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| extract pairdelim="," kvdelim="="
| rename "Transaction_ID" as "Transaction ID"
| transaction "Transaction ID"
| table _time "Transaction ID"  status duration

However, most of the time using stats to correlate event will perform way better than transaction.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...