Splunk Search

Transaction startswith argument with named fields ?

szabados
Communicator

How can I provide field values to the startswith argument of the transaction command? Like I would do in a search:
index=myindex fieldname=valueToSearchFor

I want to do the same with a transaction

0 Karma

woodcock
Esteemed Legend

I am not sure I am understanding what you need so this may be way off.

The map command is the only way to template Splunk commands, although it probably was not intended for this.
You can do something like this (assuming fieldname contains the string that you need to use with startswith😞

YourSearchThatGivesMeJustOneEventWithOneFieldWithOneValue | map search "search index=myindex | transaction startswith=\"$fieldname$\""
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...