Splunk Search

Transaction after stats/table/eval/where?

Yarsa
Path Finder

Hi, is it possible to manipulate the events of a query with a transaction after using stats/table/eval/where?
the events are kept no matter what I do to them in the query, maybe they reduce in numbers but the remaining results are the important ones for a possible transaction.

For example:

source="thesource" A="enterEvent"  | stats first(_time) as firstime last(_time)  as lastime  by userId | table firstime lastime userId | eval time_difference=(lastime-firstime)/3600 | where diff>"12" | transaction userId | table _time userId

(obviously I don't have _time anymore in my results, but can't I reuse it from the remaining events?)

Tags (1)

Ayn
Legend

No, once you've run a command that transforms the results in one way or another, the following commands in the search pipeline will only see the output of that command, so for instance after running stats the following commands do not 'see' the original events.

What you could do though is to put this in a subsearch for getting the userId's that you want to report on first, and then return those to the main search where you get the times for each of those userId's:

source="thesource" A="enterEvent" [search source="thesource" A="enterEvent"  | stats first(_time) as firstime last(_time)  as lastime  by userId | table firstime lastime userId | eval time_difference=(lastime-firstime)/3600 | where diff>"12" | fields userId] | table _time userId
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...