

09:25:01 : (2314) : Completed calling function fetchTask 09:25:01 : (2314) : Calling function fetchWkflowVarPersistValues 09:25:01 : (2314) : Completed calling function fetchWkflowVarPersistValues 09:25:01 : (2314) : Completed calling function nextSeq 09:25:01 : (1800) : Completed calling function lockObject 09:25:01 : (2314) : Calling function startWflowLog 09:25:01 : (2314) : Completed calling function startWflowLog 09:25:01 : (2314) : Calling function endTaskInstLog 09:25:01 : (2314) : Completed calling function endTaskInstLog 09:25:01 : (2314) : Calling function startTaskInstLog 09:25:01 : (2314) : Completed calling function startTaskInstLog 09:25:01 : (4644) : Calling function fetchWorkflowRunBreaks 09:25:01 : (4644) : Completed calling function fetchWorkflowRunBreaks 09:25:02 : (4127) : Calling function fetchWorkflowRunBreaks 09:25:02 : (4127) : Completed calling function fetchWorkflowRunBreaks

09:25:02 : (5677) : Calling function fetchWorkflowRunBreaks 09:25:02 : (5677) : Completed calling function fetchWorkflowRunBreaks 09:25:02 : (3624) : Calling function fetchWorkflowRunBreaks 09:25:02 : (4386) : Calling function fetchWorkflowRunBreaks 09:25:02 : (3624) : Completed calling function fetchWorkflowRunBreaks 09:25:02 : (4386) : Completed calling function fetchWorkflowRunBreaks 09:25:02 : (2702) : Completed calling function init Our logs have multiple events for the same timestamp as follows (I have simplified the logs, removing the unrelated fields w.r.to this query): Timestamp : (thread_name) : message I'm a Splunk newbie and I'm trying to write some queries for our logs using 'transaction'.
