Splunk Search

transaction query

srajanbabu
Explorer

I have a search as source="C:\\Data\\acctdata\\snm4-logger.log" | transaction FILENAME_FIELD keepevicted=true| where mvcount(BYTES_FIELD)>1 | table FILENAME_FIELD BYTES_FIELD
producing filename and bytes transferred in each file.
Also i have a search as source="C:\\Data\\acctdata\\snm4-logger.log" | transaction Plainuserip keepevicted=true| where mvcount(FILENAME_FIELD)>1 | table Plainuserip FILENAME_FIELD
producing username and files transferred by each user.
I want to combine the the above two searches to produce the result as follows

Plainuserip FILENAME_FIELD BYTES_FIELD
1 EMBT01UK file corpfile5430695 148 bytes transferred
148 bytes transferredSSNM5

Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

source="C:\\Data\\actdata\\snm4-logger.log" | transaction Plainuserip FILENAME_FIELD keepevicted = true | stats values(BYTES_FIELD) by Plainuserip FILENAME_FIELD

Might get you close to what you want.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...