Splunk Series II: Correlating Events

Introduction to Transactions

A transaction is a group of related events that span time. Events can come from multiple applications or hots.
For example, One email message can create multiple events as it travels through various queues, also visiting a single website normally generates multiple HTTP requests

Transaction field-list
can be one list field or a list of field names. Events are grouped into transactions based on the values of these fields. If multiple fields are specified and a relationship exists between those fields, events with a related field value are grouped into a single transaction.

Constraints are: –> maxspan, maxpause, startswith, endswith



Transaction Command Specific fields

Duration – the difference between the timestamp for the first and last event in the transaction
Eventcount – The number of events in the transaction


* Transactions can be useful when a single event does not provide enough information. You can use statistics reporting commands with transactions.



Transactions vs Stats

* When you have a choice use stats, it is faster and more efficient, in large Splunk environments.
* Use transactions when you need events correlated together. Must define event grouping based on start/end values or segment on time
* Use stats when you want to see results of a calculation. It can group events based on a field value.
* By default the is a limit of 1000 events per transaction, no such limit applies to stats
* Admins can change the limit by configuring max_events_per_bucket in limits.cnf


What is next?

Knowledge Objects

About the Author:

Andres Sarmiento, CCIE # 53520 (Collaboration)

You can follow Andres using Twitter, LinkedIn or Facebook

Leave a Comment


Scroll to Top