The transaction command is a Splunk command that finds transactions based on events that meet various constraints .
Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member .
The transaction command groups events together by matching one or more fields that have the same value across the events . For example, | transaction clientip will group events that have the same value in the clientip field.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit