Splunk Search

Does the "Show Source" Event Actions link not work in results after using a "transaction" command in a search?

michael_schmidt
Path Finder

Leave it to the DEV guys to find the weirdest errors...but here's the deal.

I've got a developer who needs to see his events in context, hence the use of the Show Source button. Except that he's using a Transaction command in his search, so that it "gloms" multiple events together and displays it as one log entry in the search output. Then when trying to Show Source, the Results window is balking at showing the source and kicks back:

Error in 'surrounding' command: Invalid argument: '3160:101421'
No search results for surrounding search where targetId=3160:101411 3160:101421 3160:101429 3160:101505

I assume that this is due to the fact that he's trying to show the source of an "event" that's actually a combination of multiple events and the back end programming doesn't allow for that, since how would it know which event to show in the combination.

I assume that this is the equivalent of the old man from scene 24 being asked "African or European Swallow?" and replying "I don't know that!" and being tossed into the Gorge of Eternal Peril, but I thought maybe somebody would like to know that this possibility exists, and that perhaps it should show something more like:

Source cannot be shown for Multiple Events.  (Error:5-No-3-Sir)

Has anyone else ever come up against this situation, and am I correct in my interpretation?

And I really want there to be an (Error:5-No-3-Sir) error code in a future release...

0 Karma

woodcock
Esteemed Legend

You are correct and this one more reason NOT to use transaction. Try something like this instead:

.... | stats list(_raw) AS events range(_time) AS duration BY host

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...