I have a process where I load data into database tables. My log file has the following entries for each :
TableLoad=Begin
TableName=Tablename
TableLoad=End
I have confirmed that I have the above 3 entries in the above order for each table. I also have a transaction defined as follows:
transaction startswith="TableLoad=Begin" endswith="TableLoad=End"
My Splunk report creates a separate line for each table, along with a status of the load for each. This works works well up to the point where my log file reports an error. The error is reported correctly, but the remaining lines are missing fields. For example, the next line of the report displays the next table name in the sequence, and nothing else. Each of the remaining lines are missing fields. Any idea of what I'm doing wrong?
