transactiontypes.conf
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
transactiontypes.conf
Use transactiontypes.conf to define transactions to use in searches. Each transaction type is defined by a stanza, where the transaction name is contained in [brackets]. Specify constraints for each transaction by using the same options that are defined for the transaction search command.
Transactions you define in transactiontypes.conf can be overridden by setting constraints with transaction while searching.
transactiontypes.conf.spec
# This file contains all possible attributes and value pairs for a transactiontypes.conf
# file. Use this file to configure transaction searches and their properties.
#
# There is a transactiontypes.conf in $SPLUNK_HOME/etc/bundles/default/. To set custom configurations,
# place a transactiontypes.conf in your own custom bundle directory.
#
# For help creating a bundle directory, or to learn more about bundles (including bundle precedence)
# please see the documentation located at http://www.splunk.com/doc/latest/admin/bundleconfig.
[$TRANSACTIONTYPE]
* You can have any number of transaction types, each represented by a stanza and any number
of the following attribute/value pairs.
* If you do not specify an entry for each attribute, Splunk will use the default value.
maxspan = <int>[s|m|h|d]
* Specifies the maximum time span for the transaction.
* Can be set in seconds, minutes, hours or days.
* For example: 5s, 6m, 12h or 30d.
* NOTE: IF there is NO "pattern" set (below), defaults to 5m.
* Otherwise, defaults to -1 (unlimited).
maxpause = <int>[s|m|h|d]
* Specifies the maximum pause between a complete transaction's events.
* Can be set in seconds, minutes, hours or days.
* For example: eg 5s, 6m, 12h or 30d.
* NOTE: IF there is NO "pattern" set (below), defaults to 2s.
* Otherwise, defaults to -1 (unlimited).
maxrepeats = <int>
* Specifies the maximum number of repeated event types to match against pattern (see below).
* For example, if maxrepeats is 10, and there are 100 events in a row, all with the same
eventtype, only the first and last 10 are matched against pattern.
* A negative value means no limit on repeats, but can possibly cause memory problems.
* Defaults to 10.
fields = <comma-separated list of fields>
* Takes a comma-separated list of fields.
* If set, each event must have the same field to be considered part of the same transaction.
* Defaults to "".
exclusive = <boolean>
* Specifies whether events can be in multiple transactions, or 'exclusive' to a single
transaction. Applies to the 'fields' constraint, when events are missing values and
can be in multiple transactions, without having conflicting values.
* For example, if fields="url,cookie", and exclusive="false", then an event with a 'cookie',
but not a 'url' value could be in multiple transactions that share the same 'cookie', but
have different URLs.
* Setting to 'false' causes the matcher to look for multiple matches for each event
and approximately doubles the processing time.
* Defaults to "true".
aliases = <comma-separated list of alias=event_type> (Empty)
* Defines a short-hand alias for an eventtype to be used in pattern (below).
* For example, "A=login, B=purchase, C=logout" means "A" is
equal to eventtype "login", "B" to "purchase", "C" to "logout".
* Defaults to "".
pattern = <regular expression-like pattern>
* Defines the pattern of event types for events to make up the transaction.
* Uses aliases to refer to eventtypes.
* For example, "A, B*, C" means this transaction consists of
a "login" event, followed by any number of "purchase"
events, and followed by a "logout" event.
* Defaults to "".
match = <string> (closest)
* Specifies the match type to use.
* Currently, the only value supported is "closest."
* Defaults to "closest."
transactiontypes.conf.example
# This is an example transactiontypes.conf. Use this file as a template to configure transactions types. # # To set custom configurations, place a transactiontypes.conf in your own custom bundle directory. # # For help creating a bundle directory, or to learn more about bundles (including bundle precedence) # please see the documentation located at http://www.splunk.com/doc/latest/admin/bundleconfig. [default] maxspan = 5m maxpause = 2s match = closest [purchase] aliases = A=login, B=purchase, C=logout pattern = A, B, C maxspan = 10m maxpause = 5m fields = userid
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 View the Article History for its revisions.