Splunk Search

transaction command

riqbal47010
Path Finder

I have many events against session_id. but I am interested to only list down three type of events

1- AD authentication successful
2- RADUS authentication successful
3- SMS generated

Please advise

0 Karma

efavreau
Motivator

There could be many ways to optimize your query, if you provided one. However, with the information you provided, I might start with the text of those events and put that text in my base query. Let's say your "AD authentication successful" has that actual text in the events. Then in your base query (meaning the query before the first pipe):

index=yourindex source=yoursource sourcetype=yoursourcetype "*AD authentication successful*" rest of your base query
| your other statements
| transaction command details

Then when you run the query, your base query has already filtered down to the information you are looking for. As making your base query as specific as possible is also a best practice, you will gain the additional benefit of having a faster query.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

rmmiller
Contributor

Also need to make sure that if "| your other statements" changes the order of the events, you'll need to use the sort command to put them back in reverse time order. The transaction command requires that.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...