Splunk Search

Why are field values lost using the table command after the transaction command?

tenorway
Path Finder

Hi all!

I am using the transaction command to group events based on an identifier occuring in separate indexes. Works nicely. The events shows up with all the information. In the left of the Splunk window, all expected fields from both indexes have values.

However, when trying to display some of the fields using the table command, only the fields from one of the indexes have values. The others are empty.

Piping the output from the transaction command through the fields command fixes the problem, but why is this happening?

Doesn't work (Path is blank):

index=* | rename correlationId as CID | transaction CID | table host, path

Works (Both fields have values):

index=* | rename correlationId as CID | transaction CID | fields * | table host,path

Thanks for any assistance!

0 Karma

wpreston
Motivator

Are your search results set to 'Fast Mode'? If so, Splunk will only extract the fields that it needs (like the default host, source, sourcetype, _time, etc) and the fields that you explicitly state in your search. If you want most or all fields extracted you will need to use either 'Smart Mode' or 'Verbose Mode'.

0 Karma

tenorway
Path Finder

Smart mode

0 Karma

javiergn
SplunkTrust
SplunkTrust

Not sure why both searches are not returning the same results but for the sake of performance I would use the following anyway:

index=* 
| rename correlationId as CID
| fields host, path, CID
| stats values(path) as path, values(host) as host by CID
| table host, path

tenorway
Path Finder

Thanks for the reply. The path variable will not be present in all events.
The web will log the path, and the middleware will log other fields.
Will I then be able to display the whole "transaction" in one row using stats?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...