Splunk Search

how to filter events grouped by the transaction command by a keyword in the grouping

ebailey
Communicator

I can group the correct events into a transaction using the transaction command but now I need to be able to narrow the result by a keywork in the group but I cannot get that right.

example

host=*** minutesago=5 | transunion startswith="START" endswith="END" "keyword"

When I add a keyword to the end of the query all I get is START and END grouped together and nothing else.

Any ideas?

Thanks

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion
host=xxx earliest=-5m | transaction startswith=Y endswith=Z | search keyword

View solution in original post

kristian_kolb
Ultra Champion
host=xxx earliest=-5m | transaction startswith=Y endswith=Z | search keyword

View solution in original post

ebailey
Communicator

perfect! Thanks

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.