Splunk Search

how to make transaction to consider the data from the beginning(i.e oldest data)

anooshac
Communicator

Hi all, i have a query for transaction,

source="abc_data1_*" index="testing" sourcetype="_json"
| transaction startswith=(STATUS="FAIL") endswith=(STATUS="SUCCESS")

The events in the results are considered from most recent to oldest. But i want this  transaction to consider the the older data first to the processing. I want the data to be sorted from the beginning and then apply the transaction. "Reverse" doesn't work with this.Anyone knows how to do this?

Labels (1)
0 Karma

sharynh
Splunk Employee
Splunk Employee

Have you tried Tail ?

Customer Success Manager | Public Sector
Splunker since July 2021 - still a newbie!
0 Karma

anooshac
Communicator
No. How exactly should i use that?
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| sort 0 _time
0 Karma

anooshac
Communicator

Hi sir, I am getting the events like this. only one event is older and the rest is new data.2021-08-06_19h54_34.png

As you can see only first event is older.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is your full search?

0 Karma

anooshac
Communicator
source="abc_data1_*" index="testing" sourcetype="_json"
| transaction startswith=(STATUS="FAIL") endswith=(STATUS="SUCCESS")

 This is only my full search.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

8/4/21 is not older than 7/30/21

Can you share some of your raw events as it doesn't look like your transaction command is working.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...