Transaction search

Search for transactions using the transaction search command either in Splunk Web or at the CLI. The transaction command yields groupings of events which may then be used in reports. To use transaction, either call a transaction type (that you configured via transactiontypes.conf), or define transaction constraints in your search by setting the specification options of transaction.

Search options

Transactions returned at search time consist of the raw text of each event, the shared event types, and the field values. Transactions also have additional data that is stored in the fields: duration and transactiontype. duration contains the duration of the transaction (the difference between the timestamps of the first and last events of the transaction). transactiontype is the name of the transaction (defined in transactiontypes.conf by the transaction's stanza name).

You may add transaction to any search. For best search performance, craft your search and then pipe it to the transaction command.

Follow the transaction command with the following options. Note: Some options do not work with others.

Aliases=<comma-separated list of alias=event_type>

Define a short-hand alias for eventtypes to be used in pattern (below).
For example, aliases="A=sendmail-from, B=sendmail-to".
- This means A stands for eventtype=sendmail-from.
- Read more about eventtypes.
Note: You cannot use startswith and endswith (below) when using aliases.

pattern=<quoted regular expression-like pattern>

Defines the pattern of event types in events making up the transaction.
Use the aliases you defined (above).
For example, aliases="A=sendmail-from, B=sendmail-to" pattern="A, B"

fields=<quoted comma-separated list of fields>

If set, each event must have the same field(s) to be considered part of the same transaction.
Specify multiple fields in quotes, eg. fields="field1, field2"
Events with common field names and different values will not be grouped.
- For example, if fields=host, then a search result that has "host=mylaptop" can never be in the same transaction as a search result with "host=myserver".
- A search result that has no "host" value can be in a transaction with a result that has "host=mylaptop".
Note: When specifying more than one field, you must quote all the fields, like this: transaction fields="host,thread"

match=closest

Specify the matching type to use with a transaction definition.
The only value supported currently is closest.

maxspan=[<integer> s|m|h|d]

Set the maximum pause between the events in a transaction.
Can be in seconds, minutes, hours or days.
- For example: 5s, 6m, 12h or 30d.
If there is no "pattern" set (below), defaults to 2s. Otherwise, defaults to -1 (unlimited).

maxpause=[<integer> s|m|h|d]

Specifies the maximum pause between transactions.
Requires there be no pause between a transaction's events greater than maxpause.
If the value is negative, the maxspause constraint is disabled.
The default maxpause is 2 seconds. If a pattern constraint is specified, the default maxpause is -1 (disabled)

startswith=<string>

Specify a SQLite expression that must be true to begin a transaction.
Strings must be quoted with " ".
You can use SQLite wildcards (%) and use single quotes(' ') to specify a literal term.

endswith=<quoted string>

Specify a SQLite expression that must be true to end a transaction.
Strings must be quoted with " ".
You can use SQLite wildcards (%) and use single quotes(' ') to specify a literal term.

Transactions and macro search

Transactions and macro search are a powerful combination that allow substitution into your transaction searches. Make a transaction search and then save it with $field$ to allow substitution.

Previous: Transaction types via configuration files | Next: How search works

Comments

No comments have been submitted.