Splunk Search

how to filter events grouped by the transaction command by a keyword in the grouping

Communicator

I can group the correct events into a transaction using the transaction command but now I need to be able to narrow the result by a keywork in the group but I cannot get that right.

example

host=*** minutesago=5 | transunion startswith="START" endswith="END" "keyword"

When I add a keyword to the end of the query all I get is START and END grouped together and nothing else.

Any ideas?

Thanks

Tags (1)
0 Karma
1 Solution

Ultra Champion
host=xxx earliest=-5m | transaction startswith=Y endswith=Z | search keyword

View solution in original post

Ultra Champion
host=xxx earliest=-5m | transaction startswith=Y endswith=Z | search keyword

View solution in original post

Communicator

perfect! Thanks

0 Karma