How can I provide field values to the startswith argument of the transaction command? Like I would do in a search:
index=myindex fieldname=valueToSearchFor
I want to do the same with a transaction
I am not sure I am understanding what you need so this may be way off.
The map
command is the only way to template Splunk commands, although it probably was not intended for this.
You can do something like this (assuming fieldname
contains the string that you need to use with startswith
😞
YourSearchThatGivesMeJustOneEventWithOneFieldWithOneValue | map search "search index=myindex | transaction startswith=\"$fieldname$\""