Hello, I have an index with events, where events belong to a transaction (transaction_id). I am interested in transactions which contain exact two event with specific eventtype (type1 and type2). When I have all the transaction(_ids) which contain those two eventtypes, I want to join to the events again to get those complete transactions, including all their events. There might be events with other eventtypes as well which need to be retrieved. This is what I tried:   index="data" | stats values(eventtype) as eventtype by transaction_id | search eventtype="TYPE1" AND eventtype="TYPE2" | table transaction_id | join type=inner transaction_id[search index="data"] | table *   But this query returns only a fraction of the available matching transactions. I read some other posts with all kind of approaches, is it really so hard in Splunk to get such tasks done? ... View more

Coming from SQL, I want to do stuff like GROUP BY and HAVING ... The data is available with a transaction identifier.Grouing should be done by that transaction identifier. Per transaction, I want to check a few attributes, if their values are unique within each treansaction. In SQL terms: select transaction_id from index group by transaction_id having count(distinct attr1) = 1 and count(distinct attr2) = 1 and count(distinct attr3) = 1 From that table of transaction_ids, a join to the same index should be done to filter the events. How can I achieve this with Splunk query?   ... View more