Splunk Search

Transaction Events Issue

jberlin
Path Finder

My search is partially working in the aspect that it returns event data, however all of the events are mashed into one and the duration is calculated off the first event and the last event.

Search Command:
(index=jjj host=server OR host=server2 (inbound OR outbound)) | xmlkv | table _time, host, TokenId, inbound, outbound, _raw | transaction TokenId | search TokenId="$tokenId$"

I would like to the returned data to show each event as they occur or inbound event and outbound event for 1 duration time. Then move on to the next event and so on.

jb

Tags (1)
0 Karma
1 Solution

jberlin
Path Finder

Adding maxspan and maxpause to the transaction resolved the problem.

View solution in original post

0 Karma

jberlin
Path Finder

Adding maxspan and maxpause to the transaction resolved the problem.

0 Karma

lguinn2
Legend

Don't use the transaction command, then. It might also be helpful if you explained your data a little more. What do you mean "for 1 duration time"? What exactly do you want the output to look like?

In the meantime, I suggest this:

(index=jjj host=server OR host=server2 (inbound OR outbound)) "$tokenId$" 
| xmlkv 
| search TokenId="$tokenId$"
| table  _time, host, TokenId, inbound, outbound, _raw 
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...