Splunk Search

how to filter events grouped by the transaction command by a keyword in the grouping

ebailey
Communicator

I can group the correct events into a transaction using the transaction command but now I need to be able to narrow the result by a keywork in the group but I cannot get that right.

example

host=*** minutesago=5 | transunion startswith="START" endswith="END" "keyword"

When I add a keyword to the end of the query all I get is START and END grouped together and nothing else.

Any ideas?

Thanks

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion
host=xxx earliest=-5m | transaction startswith=Y endswith=Z | search keyword

View solution in original post

kristian_kolb
Ultra Champion
host=xxx earliest=-5m | transaction startswith=Y endswith=Z | search keyword

View solution in original post

ebailey
Communicator

perfect! Thanks

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!