Transaction types via configuration files

Transaction types via configuration files

Any series of events can be turned into a transaction type. Read more about use cases in how transaction types work.

You can create transaction types via transactiontypes.conf. See below for configuration details. For more information on configuration files in general, see how configuration files work.

Configuration

1. Create a transactiontypes.conf file in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/.

2. Define transactions by creating a stanza and listing specifications for each transaction within its stanza. Use the following attributes:

[<transactiontype>]
maxspan =  [<integer> s|m|h|d]
maxpause = [<integer> s|m|h|d]
maxrepeats = <integer>
fields = <comma-separated list of fields
exclusive = <true | false>
aliases = <comma-separated list of alias=event_type>
pattern = <ordered pattern of named aliases>
match = closest

[<TRANSACTIONTYPE>]

• Create any number of transaction types, each represented by a stanza name and any number of the following attribute/value pairs.
• Use the stanza name, [<TRANSACTIONTYPE>], to search for the transaction in Splunk Web.
• If you do not specify an entry for each of the following attributes, Splunk uses the default value.

maxspan = [<integer> s|m|h|d]

• Set the maximum time span for the transaction.
• Can be in seconds, minutes, hours or days.
  • For example: 5s, 6m, 12h or 30d.
• If there is no "pattern" set (below), defaults to 5m. Otherwise, defaults to -1 (unlimited).

maxpause = [<integer> s|m|h|d]

• Set the maximum pause between the events in a transaction.
• Can be in seconds, minutes, hours or days.
  • For example: 5s, 6m, 12h or 30d.
• If there is no "pattern" set (below), defaults to 2s. Otherwise, defaults to -1 (unlimited).

maxrepeats = <integer>

• Set the maximum number of repeated event types to match against pattern (see below).
• For example, if maxrepeats is 10, and there are 100 events in a row, all with the same eventtype, only the first and last 10 are matched against pattern.
• A negative value means no limit on repeats, but can possibly cause memory problems.
• Defaults to 10.

fields = <comma-separated list of fields>

• If set, each event must have the same field(s) to be considered part of the same transaction.
• Defaults to "".

exclusive = <true | false>

• Toggle whether events can be in multiple transactions, or 'exclusive' to a single transaction.
• Applies to 'fields' (above).
• For example, if fields=url,cookie, and exclusive=false, then an event with a 'cookie', but not a 'url' value could be in multiple transactions that share the same 'cookie', but have different URLs.
• Setting to 'false' causes the matcher to look for multiple matches for each event and approximately doubles the processing time.
• Defaults to "true".

aliases = <comma-separated list of alias=event_type>

• Define a short-hand alias for an eventtype to be used in pattern (below).
• For example, A=login, B=purchase, C=logout means "A" is equal to eventtype=login, "B" to "purchase", "C" to "logout".
• Defaults to "".

pattern = <regular expression-like pattern>

• Defines the pattern of event types in events making up the transaction.
• Uses aliases to refer to eventtypes.
• For example, "A, B, B, C" means this transaction consists of a "login" event, followed by a two "purchase" events, and followed by a "logout" event.
• Defaults to "".

match = closest

• Specify the match type to use.
• Currently, the only value supported is "closest."
• Defaults to "closest."

3. Use the transaction command in Splunk Web to call your defined transaction (by its transaction type name). You can override configuration specifics during search. Read more about transaction search.