Splunk Cloud Platform

Search Reference



Efficiently returns transaction events that match a transaction type and contain specific text.

For Splunk Cloud Platform, you must create a private app that contains your transaction type definitions. If you are a Splunk Cloud administrator with experience creating private apps, see Manage private apps in your Splunk Cloud Platform deployment in the Splunk Cloud Admin Manual. If you have not created private apps, contact your Splunk account representative for help with this customization.


| searchtxn <transaction-name> [max_terms=<int>] [use_disjunct=<bool>] [eventsonly=<bool>] <search-string>

Required arguments

Syntax: <transactiontype>
Description: The name of the transaction type stanza that is defined in transactiontypes.conf.
Syntax: <string>
Description: Terms to search for within the transaction events.

Optional arguments

Syntax: eventsonly=<bool>
Description: If true, retrieves only the relevant events but does not run "| transaction" command.
Default: false
Syntax: maxterms=<int>
Description: Integer between 1-1000 which determines how many unique field values all fields can use. Using smaller values speeds up search, favoring more recent values.
Default: 1000
Syntax: use_disjunct=<bool>
Description: Specifies if each term in <search-string> should be processed as if separated by an OR operator on the initial search.
Default: true


The searchtxn command is an event-generating command. See Command types.

Generating commands use a leading pipe character and should be the first command in a search.


The command works only for transactions bound together by particular field values, not by ordering or time constraints.

Suppose you have a <transactiontype> stanza in the transactiontypes.conf.in file called "email". The stanza contains the following settings.

  • fields=qid, pid
  • search=sourcetype=sendmail_syslog to=root

The searchtxn command finds all of the events that match sourcetype="sendmail_syslog" to=root.

From those results, all fields that contain a qid or pid located are used to further search for relevant transaction events. When no additional qid or pid values are found, the resulting search is run:

sourcetype="sendmail_syslog" ((qid=val1 pid=val1) OR (qid=valn pid=valm) | transaction name=email | search to=root


Example 1:

Find all email transactions to root from David Smith.

| searchtxn email to=root from="David Smith"

See also


Last modified on 18 August, 2021
search   selfjoin

This documentation applies to the following versions of Splunk Cloud Platform: 8.2.2112, 8.2.2201, 8.2.2202, 9.0.2205, 8.2.2203, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308 (latest FedRAMP release), 9.1.2312, 9.2.2403

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters