Using transaction is rarely a good solution, as it has numerous limitations and results will silently disappear, as you have noticed. It seems you're looking for the same msg within a 5 minute window, that has a syscall and not from certain comm types, but given that audit messages are typically time based, can you elaborate on what you're trying to do here. You are asking Splunk to hold 5 minutes of data in memory for every msg combination, so if your data volume is large then lots of those combinations will get discarded. Whenever you use transaction, you should filter out as much data as possible before you use it. Can you give an example of what groups of events you are trying to collect together - the stats command is generally a much better way of doing this task and does not have limitations. Also, note that sort by date is not valid SPL as "by" is treated here as a field and not a command word - just use sort date     ... View more

Hi @Codyy_Fast, using the table command you have all the (e.g.) 4625 events, you can also group them using the stats command: index=Wineventlog sourcetype=wineventlog source::WinEventLog:Security (EventCode=4625 OR EventCode=4740) | eval Benutzerkonto = coalesce(Kontoname, Account_Name) | eval Meldung = coalesce(Fehlerursache, Failure_Reason) | eval IP-Quelladresse = coalesce(Source_network_address, Quellnetzwerkadresse) | stats count earliest(_time) AS earliest latest(_time) AS latest values(Benutzerkonto) AS Benutzerkonto values(Meldung) AS Meldung values(IP-Quelladresse) AS IP-Quelladresse BY ComputerName but it depends on what are the requisites of yoru search, in other words: what do you want to find? In addition, if possible don't use "-" or spaces in your field names, use "_" because Splunk translate it as the subtraction operator. Ciao. Giuseppe ... View more

Hi, thanks for your Reply! Everything worked, thank you! I have installed the Linux Unix add-on on the deployment server. Then I moved it from /opt/splunk/etc/apps to /opt/splunk/etc/deployment-apps. After that, I was able to deploy the app via the Splunk web interface.   Greetings! ... View more