I need to find hosts on which Event B occurred within three minutes of Event A. I'm trying to use transaction, but I seem to be running into the problem that a transaction is marked closed if either maxspan or startswith is satisfied, and I want all three of these constraints to be satisfied:
Event A is far more common than Event B, so I end up with a lot of transactions consisting only of Event A, which is annoying. unifyends=t doesn't work; A and B have nothing in common with each other, so I just end up with Event A-only transactions. I could try to filter by the EventCode field after the transactions are created, but that seems silly; transaction should be able to do this implicitly. Can I do something in the transaction command to make it honor all three constraints? I am running Splunk 4.3.4.