Splunk Search

How do I separate the results of a transaction to separately show each event?

gcusello
SplunkTrust
SplunkTrust

Hi at all,

I have to separate the results of a transaction to separately show each event.
I'd like to do this because I have to aggregate events into a transaction to verify some rules (eventcount), but after, I'd like to separately show events.

How can I do this?
thank you.
Bye.
Giuseppe

1 Solution

javiergn
SplunkTrust
SplunkTrust

Try this:

tag=SM 
| transaction sourcetype Application maxspan=300s mvraw=true
| eval myRaw = _raw
| mvexpand myRaw 
| rename myRaw as _raw

View solution in original post

woodcock
Esteemed Legend

Don't use transaction in the first place.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Try this:

tag=SM 
| transaction sourcetype Application maxspan=300s mvraw=true
| eval myRaw = _raw
| mvexpand myRaw 
| rename myRaw as _raw

fdi01
Motivator

What is the query that you're using to generate the results?

0 Karma

gcusello
SplunkTrust
SplunkTrust

It's a very simple search:
tag=SM | transaction sourcetype Application maxspan=300s

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...