Splunk Search

Is it possible to extract a field from a transaction event?

the_wolverine
Champion

My field extraction doesn't appear to work in my transaction event. Does Splunk just combine all the various fields from multiple events when there is a transaction?

Lowell
Super Champion

Field extractions happens in your base search, so therefore any | transaction ... command you are using is happening after field extraction has already been performed.

You have a couple of options:

  1. Extract the field before your transaction (if possible)
  2. Extract your field using a rex command after your transaction
  3. If you have a field extraction already established in your transforms.conf, then you can use | extract <stanza-name> after your transaction to extract the field(s) you want.

The transaction command by default will capture all distinct values for any fields that exist in the search pipeline before the transaction command. By default, if a field has multiple values, then a multi-value field will be created that contains all the distinct values. If you would like to instead have a list of the origional values, in their origional order, then you can use the mvlist parameter to specify that. (See the docs for the transform command). I like to think of this as difference between the values(field) and list(field) stats commands.

Does that help?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...