Splunk Search

Why isn't transaction working for me?


I have a process where I load data into database tables.   My log file has the following entries for each :


I have confirmed that I have the above 3 entries in the above order for each table.  I also have a transaction defined as follows:

transaction startswith="TableLoad=Begin" endswith="TableLoad=End"

My Splunk report creates a separate line for each table, along with a status of the load for each.  This works works well up to the point where my log file reports an error.    The error is reported correctly, but the remaining lines are missing fields.  For example, the next line of the report displays the next table name in the sequence, and nothing else.   Each of the remaining lines are missing fields.   Any idea of what I'm doing wrong?


Labels (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...