Hello i have a problem with searchtxn:
"Error in 'searchtxn' command: This command must be the first command of a search."
and i don't understand how to use it correctly. i have events f...
I've something of a challenge: How to best generate a single event in a summary index that is based on a transaction across four different fields when there is not a 1:1 relationship across all the f...
Currently we are looking ingesting events that have multiple eventIDs that log in new lines. We want to have those appear as one event in splunk since trying to run a "| transaction event_id" slows o...
Scenario:
I am searching email event logs. I can find some of the needed fields by a unique id (UID) and I find some fields by diffferent unique id (X-UID). Some events contain both UID and X-UID...
I am attempting to set up an initial transactiontypes.conf file in $SPLUNK_HOME/etc/system/local so I can use [searchtxn], however, I am not understanding the documentation and setup correctly.
T...
When searching for email addresses in our sendmail logs, it helps to see the full transaction by using the queue id (qid) field.
Search command:
sourcetype="sendmail_syslog" | transaction fiel...
So I’m trying to link a couple different fields together to get the data I’m looking for, but it involves a couple steps and not sure how to put this subsearch together. I’ve been able to extract fie...
I'm sorry, I am not even sure how to ask this question or whether the subject line really explains what I am after.
I am looking at IronPort logs and have to nest a search in order to get all the ...
I have a multithreaded application that writes out intermingled logs and having performance issues searching with transactions, and looking for a simpler way to coalesce events.
simplified mylog.l...