Splunk® Enterprise

Knowledge Manager Manual

Download manual as PDF

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Define transactions

Any series of events can be turned into a transaction type. Read more about use cases in "About transactions", in this manual.

You can create transaction types via transactiontypes.conf. See below for configuration details.

For more information on configuration files in general, see "About configuration files" in the Admin manual.

Configure transaction types in transactiontypes.conf

1. Create a transactiontypes.conf file in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/.

2. Define transactions by creating a stanza and listing specifications for each transaction within its stanza. Use the following attributes:

maxspan =  [<integer> s|m|h|d]
maxpause = [<integer> s|m|h|d]
fields = <comma-separated list of fields>
exclusive = <true | false>
match = closest


  • Create any number of transaction types, each represented by a stanza name and any number of the following attribute/value pairs.
  • Use the stanza name, [<TRANSACTIONTYPE>], to search for the transaction in Splunk Web.
  • If you do not specify an entry for each of the following attributes, Splunk uses the default value.

maxspan = [<integer> s|m|h|d]

  • Set the maximum time span for the transaction.
  • Can be in seconds, minutes, hours or days.
    • For example: 5s, 6m, 12h or 30d.
  • Defaults to 5m.

maxpause = [<integer> s|m|h|d]

  • Set the maximum pause between the events in a transaction.
  • Can be in seconds, minutes, hours or days.
    • For example: 5s, 6m, 12h or 30d.
  • Defaults to 2s.

fields = <comma-separated list of fields>

  • If set, each event must have the same field(s) to be considered part of the same transaction.
  • Defaults to "".

exclusive = <true | false>

  • Toggle whether events can be in multiple transactions, or 'exclusive' to a single transaction.
  • Applies to 'fields' (above).
  • For example, if fields=url,cookie, and exclusive=false, then an event with a 'cookie', but not a 'url' value could be in multiple transactions that share the same 'cookie', but have different URLs.
  • Setting exclusive = false causes the matcher to look for multiple matches for each event and approximately doubles the processing time.
  • Defaults to "true".

match = closest

  • Specify the match type to use.
  • Currently, the only value supported is "closest."
  • Defaults to "closest."

3. Use the transaction command in Splunk Web to call your defined transaction (by its transaction type name). You can override configuration specifics during search.

For more information about searching for transactions, see "Search for transactions" in this manual.

Search for transactions
About lookups and workflow actions

This documentation applies to the following versions of Splunk: 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.1.8, 4.2, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7 View the Article History for its revisions.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole
Feedback you enter here will be delivered to the documentation team

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters