We'll start by defining two important Splunk terms: transactions and transaction types.
"A transaction is any group of conceptually-related events that spans time." | ||
| --Splunk documentation | ||
To illustrate, an out of disk space condition might trigger several server events to be recorded (possibly even from multiple hosts or applications), and they can all be grouped together into a single transaction.
It is important to understand that events don't have to be physically linked to be thought of as a transaction. Experience with an organization's environment or knowledge of an application, for example, might provide information that logically relates events.
Reiterating a transaction is defined as a collection of conceptually-related events that occur over a period of time. A transaction type is a transaction that has been saved or defined in Splunk. Note that what we mean by saved in Splunk is that the transaction has been configured (that is, set up in the transactiontypes...