Splunk Search

Transaction missing fields

ericrobinson
Path Finder

I have a search defining a Transaction across (2) different log files. The problem is that some fields (not all) are missing in the results when using the transaction command. When I search for the events in the individual logs, the fields are present. Any ideas? These are all FIELD=VALUE.

Tags (1)

ccdeflon
New Member

I ran in to the same issue, and after unsuccessfully trying to wrap my head around why Splunk sometimes "forgets" some of its field extractions when transaction is used I reverted to just rex extracting them from _raw after transaction and joined them. Not the prettiest of solutions, but it was the only way I was getting it to work.

0 Karma

woodcock
Esteemed Legend

Are you using startswith and endswith? If so you might be evicting unclosed transactions so add keepevicted=t.

0 Karma

Jason
Motivator

I am noticing this problem too. When I search for the first event in my transaction, I see 100% of them with the dest field. When I transact them together with a few nearby log entries that do not have dest fields, ... SOME transactions have dest, some do not.

0 Karma

jrodman
Splunk Employee
Splunk Employee

Are they still missing if you use |fields and specify that field? (I'd guess yes, but don't know.)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...