The transaction command has been helping me to correlate two events. Is there a way for me to find out the event that is not falling into the transaction?
event1, hostid
event2, hostid
|transaction hostid startswith=event1, endswith=event2
This will give me all the hostid that falls into both event1 and event2. How do I find out the hostid which is ONLY in event1 or event2?
Thanks,
I believe the "keeporphans" flag is what you are looking for:
keeporphans=<bool>
Description: Specify whether the transaction command should output the results that are not part of any transactions. The results that are passed through as "orphans" are distinguished from transaction events with a _txn_orphan field, which has a value of 1 for orphan results. Defaults to false.
Got this from the Splunk docs on transactions.
Hope this helps.
I believe the "keeporphans" flag is what you are looking for:
keeporphans=<bool>
Description: Specify whether the transaction command should output the results that are not part of any transactions. The results that are passed through as "orphans" are distinguished from transaction events with a _txn_orphan field, which has a value of 1 for orphan results. Defaults to false.
Got this from the Splunk docs on transactions.
Hope this helps.
the keepophans will include hostid that is in both event1 and event2, as well either event1 or event2. However, I am interested in ONLY in event1 or event2.
@jgsco
Use | search _txn_orphan=1
after the transaction. That should return only the "orphans".
Thanks! That worked.