Splunk Search Command of the Week: Transaction

Have you ever needed to see how long a server has been down? Or maybe find the duration of processing calls? Instead of trudging through a bunch of complicated eval statements or subtracting different time intervals, Splunk has made it simple with an all-in-one Splunk search command: Transaction.

Transaction allows us, the users, to correlate similar events, based on different constraints to transactional (I said the magic word) information. This is usually information such as duration between events and number of events (or eventcount).

How to Use Transaction

Using the transaction command is a lot simpler than it might seem. To use it in a Splunk search command, just follow this format :


And that’s it. That’s the only requirement for using this command. However, to get the most accurate results, it would be best to add a few more items to the line:

|transaction <field> maxevents=# startswith= “<value>” endswith=”<value>”

Transaction Use Cases

This is a solid foundation for most use cases, let’s break it down:

<field> – this would be a field that correlates between the events, something to match events with

Maxevents – maximum number of events between each transaction

Startswith – events containing this term will start off the transaction event

Endswith – events containing this term will close off the transaction event

Let’s look at an example. I have a list of different servers that generate a status event and a timestamp:

Figure 1 - Servers that generate a status event and a timestamp

Figure 1 – Servers that generate a status event and a timestamp

Now what I want to do is create transaction between these events to find the duration in which a server was down. To do this, I’ll want to write a line similar to this:

|transaction server maxevents=2 startswith=”Down” endswith=”Up”

Transaction Results

Look for these results when running your transaction search command…

Server – the field we match on

Maxevent=2 – we ONLY want to see a singular UP and DOWN event

Startswith=Down – we need the Down event to start us off to find the duration a server has been down

Endswith=Up – this will close off the transaction indicating the server is back up

Ask the Experts

Our Splunk Search Command of the Week series is created by our Expertise on Demand (EOD) experts. Every day, our team of Splunk certified professionals works with customers through Splunk troubleshooting support, including Splunk search command best practice. If you’re interested in learning more about our EOD service or chat with our team of experts, fill out the form below!


Start typing and press Enter to search