Hi, I am pretty much new to Splunk and was exploring various options. There is a specific case in our project where in we need to capture a transation completely. The transaction can be identifed by a start string and an end string e.g Started the Event 123456 XXXX YYY ZZZ AAAA BBBB Completed the event 123456 The above example illustrates the specific set of activity by an event and the only identifier to capture the event is the ID and I want all the log traces between those two lines(start and completed). Can we do this using Splunk? If so, can I get some tips on this? I did some work by searching the strings, ids etc but all I can get, was just the line not the entire transaction from that event. Appreciate any help ... View more