"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
"True.
In that case, you might as well isolate Splunk in its own 'directory' via the following configuration directives:
Apache configuration:
ProxyPass /splunk http://127.0.0.1:8000/splunk
ProxyPassReverse /splunk…"
"A more compact version of the Apache2 directives would be:
ProxyRequests off
ProxyPass / http://127.0.0.1:8000/
ProxyPassReverse / http://127.0.0.1:8000/
Additionally, the following must be set in the Splunk 4.x web.conf:
tools.proxy.on =…"