Have a look at my events indexed in Splunk:
As you can see, there are basically two different transactions when using the PID field as transaction identifier. Between those two transactions, there's an event which helps me to connect both of them. Any idea how to use the transaction search command, to connect those two transactions using the event with the additional informations?
Note: If necessary, I can rename the fields in the event with the additional informations.
asked 12 Jan '12, 00:45
Could you not just take your original transaction that returns the above and pipe that into another transaction with the event that connects the two?
Ok so you would perform a generic search to gather your data and you could then pipe to transaction to combine the events. You could then pipe it again to transaction to combine events based on a different field, so lets assume that HISTORY is the similar factor and you want to combine all transactions that have HISTORY, and we'll assume this HISTORY is extracted to field 'type'.
searchterm | transaction pid | transaction type
From memory I believe that would do what you want to achieve. Transaction is quite a heavy command though so others may have a better solution and you wouldn't want to do this over particularly large time periods unless you had the time to wait. Have a look at the docs (which I assume you already have from your comment) to see ways to extend and tune this search; http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transaction
EDIT: If you run the first transaction what is returned? If you then pipe into a second transaction and include keeporphans=true what is returned? this will force Splunk to return events that didn't meet the transaction rules.
What if you did a transaction comamnd to join events with the same PID. In your exampel above, you would then have two resultant events. The event with "PID=28489 UID=501" would the nalso have a field "ORIG_UID". Then pipe that to a selfjoin where ORIG_UID=UID.
answered 12 Jan '12, 10:05
Try normalizing the field name before calling
If each line in your original post is a separate event, then you should be able to do something like:
Also, you may want to consider using the