Have you ever needed to see how long a server has been down? Or maybe find the duration of processing calls? Instead of trudging through a bunch of complicated eval statements or subtracting different time intervals, Splunk has made it simple with an all-in-one Splunk search command: Transaction.
Transaction allows us, the users, to correlate similar events, based on different constraints to transactional (I said the magic word) information. This is usually information such as duration between events and number of events (or eventcount).
How to Use Transaction
Using the transaction command is a lot simpler than it might seem. To use it in a Splunk search command, just follow this format :
And that’s it. That’s the only requirement for using this command. However, to get the most accurate results, it would be best to add a few more items to the line:
|transaction <field> maxevents=# startswith= “<value>” endswith=”<value>”
Transaction Use Cases
This is a solid foundation for most use cases, let’s break it down:
<field> – this would be a field that correlates between the events, something to match events with
Maxevents – maximum number of events between each transaction
Startswith – events containing this term will start off the transaction event
Endswith – events containing this term will close off the transaction event
Let’s look at an example. I have a list of different servers that generate a status event and a timestamp:
Now what I want to do is create transaction between these events to find the duration in which a server was down. To do this, I’ll want to write a line similar to this:
|transaction server maxevents=2 startswith=”Down” endswith=”Up”
Look for these results when running your transaction search command…
Server – the field we match on
Maxevent=2 – we ONLY want to see a singular UP and DOWN event
Startswith=Down – we need the Down event to start us off to find the duration a server has been down
Endswith=Up – this will close off the transaction indicating the server is back up
Ask the Experts
Our Splunk Search Command of the Week series is created by our Expertise on Demand (EOD) experts. Every day, our team of Splunk certified professionals works with customers through Splunk troubleshooting support, including Splunk search command best practice. If you’re interested in learning more about our EOD service or chat with our team of experts, fill out the form below!