How transaction types work
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
How transaction types work
A transaction type is a grouping of events that contain related pieces of information. Any number of data sources can generate transactions over multiple log entries. Transaction search is useful for a single observation of any physical event stretching over multiple logged events.
Here are some typical entries that could be grouped as a transaction:
- An event in a Web access log
- An event in an application server log
- An event in an asynchronous fulfillment application that generates a message queue that subsequently identifies a business transaction
In this case, the Web access log might share a session ID with the event in the application server log; the application server log might contain the account ID, transaction ID, and product ID; the transaction ID may live in the message queue with a message ID, and the fulfillment application may log the message ID along with the shipping status. All of this data represents a single user transaction.
Define transactions
Define transactions in two ways:
- By editing transactiontypes.conf:
- Define transactions by creating a stanza and listing specifications.
- In your search terms:
- Use the
transactioncommand to define a transaction or override transaction options specified intransactiontypes.conf.
- Use the
Sample use cases
There are many cases where transactions are useful. Here are some use cases for transaction search:
- Find quarantined mail messages where:
- All events printed to a mail log for the different steps in processing a given message are considered to be a transaction.
- All events in the transaction share a message ID or a process ID with events that have both a process ID and message ID providing the transition.
- Queue entry events containing the sender's email address, and separate delivery events for each recipient of the message.
- To find a security issue:
- A sequence of 3 specific error messages in a particular order within a time frame on a given host that may be consistent with a known failure or attack pattern.
- To combine any combination of specific event types:
- Any transaction from a single data source that generates multiple log entries for a single event.
This documentation applies to the following versions of Splunk: 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 View the Article History for its revisions.