"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
Sorry about the spam on the blogs. Working with NING to solve that. I'm happy to elevate the privileges of certain users if you'd like to help police the site. Just send me a note!
You need to be a member of splunkninja to add comments!
Join splunkninja