Splunk Transaction: The transaction command detects transactions based on events that meet various constraints. Transactions are made up of the raw text (_rao field) of each member, first the member’s time and date fields, as well as all other regions of each member.

Additionally, the transaction command adds two fields to the raw events, duration, and a number of events. Period field values ​​show the difference between the timestamp for the first and last events in a transaction. The values ​​in the event count field indicate the number of events in the transaction.

Search options

Transactions returned at search time include the raw text of each event, the shared event type, and the field values. Transactions also contain additional data that is stored in fields: duration and transaction type.

Duration is the duration of the transaction (the difference between the timestamp of the first and last events of the transaction).
Transaction-type is the name of the transaction (as defined in transaction types. Defined by the verse name of the transaction).
You can add transactions to any search. For best search performance, craft your search and then pipe it to the transaction command. For more information, see the topic on Transaction Commands in the Search Reference Manual.

Read This: Onyx cloud serpent | how to get heavenly onyx cloud serpent

How to Use Transaction

The transaction order is much easier to use than it may seem. To use it in the Splunk search command, just follow this format:

| transactions

And all. The only requirement to use this command is, however, to get the most accurate results, it would be best to add a few more items to the line:

|transaction <field> maxevents=# startswith= “<value>” endswith=”<value>”

Full Guide Video Tutorial Splunk Transaction

Download Full Topic As PDF PDF Credit- https://docs.splunk.com/