Mastering Splunk

Chapter 9. Transactional Splunk

This chapter will define and describe Splunk transactions from an enterprise (or global to the organization) perspective.

The following topics will be covered in this chapter:

• Transactions and their types
• Advanced use of transactions such as:
  • Configuring transaction types
  • Grouping events
  • Concurrent events
  • What to avoid?

In Chapter 2, Advanced Searching, we talked briefly about Splunk transactional searching. In this chapter, we will take a much closer look at this important topic.

Transactions and transaction types

We'll start by defining two important Splunk terms: transactions and transaction types.

	"A transaction is any group of conceptually-related events that spans time."
	--Splunk documentation

To illustrate, an out ...