Splunk Search

How to use transaction

john
Communicator

Hi,

User want to see 100 events after a particular event or String eg Id=987.
I have used transaction for that.But after 30 events "Id=987" is appearing again in logs so splunk breaks the events.So that only 30 records are able to clump.

This is the query iam using.
index="" source="" | transaction maxevents=300 startswith="Id=987"| search 987|sort _time

What i am looking for is transaction should strats with first occurence of id and it should group all next 100 0r 200 records irresptive of breaking on next occurence of id.Please help

Tags (2)
0 Karma

davecroto
Splunk Employee
Splunk Employee

startswith and endswith:

startswith=

A search or eval-filtering expression which, if satisfied by an event, marks the beginning of a new transaction.
For example:
    startswith="login"
    startswith=(username=foobar)
    startswith=eval(speed_field < max_speed_field)
    startswith=eval(speed_field < max_speed_field/12) 
Defaults to "". 

endswith=

A search or eval-filtering expression which, if satisfied by an event, marks the end of a transaction.
For example:
    endswith="logout"
    endswith=(username=foobar)
    endswith=eval(speed_field < max_speed_field)
    endswith=eval(speed_field < max_speed_field/12) 
Defaults to "". 

sdaniels
Splunk Employee
Splunk Employee

Does each of the 100 events you want to look at have the 'Id=987'? If so, you should have a field called 'Id' and then you'd do this:

 ... | transaction Id maxevents=100 

This will created a transaction of all events witha given Id and show you 100 of them. By default the maximum number of events in a transaction is 1000.

Look at example 4 in the docs. This shows multiple ids that are being correlated for a transaction but you'll get the idea by looking at the raw events below the example.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transaction

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...