Splunk Search

How do you reference the value of a transaction

adylent
Path Finder

Does anyone know if it is possible to reference the value of a transaction?

For instance

transaction account  startswith="event_type=login" endswith="event_type=logout" 

At this point I should have events encapsulating full user sessions (per account). Can I reference the value of a transaction?

Ideally I'd like to do something like

rex field=transaction mode=sed "s/oldvalue/newvalue/g"  

without have to do this on the _raw prior to the transaction.

Thanks greatly

0 Karma
1 Solution

kristian_kolb
Ultra Champion

After the transaction command, all events that make up the transaction are stored in the _raw field. The old _raw is gone. Of course, events are only changed for the duration of the search - and not changed on disk.

Try it out, just as you wrote it, but remove the field=transaction part.

... | transaction account  startswith="event_type=login" endswith="event_type=logout" 
| rex mode=sed "s/oldvalue/newvalue/g"

/k

View solution in original post

kristian_kolb
Ultra Champion

After the transaction command, all events that make up the transaction are stored in the _raw field. The old _raw is gone. Of course, events are only changed for the duration of the search - and not changed on disk.

Try it out, just as you wrote it, but remove the field=transaction part.

... | transaction account  startswith="event_type=login" endswith="event_type=logout" 
| rex mode=sed "s/oldvalue/newvalue/g"

/k

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...