Splunk Search

Multiple events returned in a single transaction - possible to create a single row in a table/csv file?

the_wolverine
Champion

I've got a transaction that returns 2 events. Originally these are 3 events but the transaction has combined 2 of them (I assume since they are from the same index/sourcetype.) When I output the fields (via outputcsv), I get 3 rows. Is it possible to have the output returned as a single row - as in a single transaction?

Here's an example of my search:

(index=corp OR index=mail) (sourcetype=fireeye OR sourcetype=imap) (fenotify=* OR Machine=*) 
  | transaction fenotify src_host connected=f maxspan=5m maxpause=5m 
  | fields + Date,Machine,src_ip,Subject,cef_dvendor,sname,dest_cnc_name,dest_cnc_channel_user_agent
0 Karma

southeringtonp
Motivator

IIRC, the call to fields with the plus sign won't get rid of the reserved fields. I'm guessing you're also still seeing _raw, _cd, and friends in the CSV?

Try adding a call to:

| fields - _*
0 Karma

the_wolverine
Champion

I'm not seeing any unspecified fields with this search but the issue is that the fields returned show up in multiple rows because these are actually multiple events

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...