Where to place 'transaction' criteria in a Splunk query - splunk

Question

The intent here is to use the Splunk
transaction startswith
in conjunction with a query that specifies a pair of fields and a free form search string. What is the correct structuring/ordering of the query?
To start with: the following query returns a few records:
index=dev sourcetype="alstest-tuning--1-0-50--*" Error
Now we want to view some records following each of the results. Here are a couple of attempts:
transaction startswith("index=dev sourcetype=\"alstest-tuning--1-0-50--*\" Error") maxevents=20
and
index=dev sourcetype="alstest-tuning--1-0-50--*" transaction startswith("Error") maxevents=20
Neither of those approaches returns anything. The first one also surfaces a related question: how to escape the quotes for the fields. Pointers appreciated.

Answer 1

The way of using transaction is different. Let me brief on Splunk transaction command:
A transaction is any group of related events that span time
Events can come from multiple applications or hosts
Events related to single purchase from an online store can span across an application server, database, and e-commerce engine
One email message can create multiple events as it travels through various queues
Each event in the network traffic logs represents a single user generating a single http request
Visiting a single website normally generates multiple http requests
Syntax of transaction command
transaction [field-list] [name=transaction-name] [transaction_definition-opt]*
The events are grouped into transactions based on the values of this field list
If a quoted list of fields is specified, events are grouped together if they have the same value for each of the fields
Common constraints maxspan | maxpause | maxevetns | startswith | endswith
How to use transaction command:
combine all the events by SESSIONID
index=index_name sourcetype=some-source-type | transaction SESSIONID
With the transaction command, we can also use tables to easily view the information that we want: index=* | transaction SESSIONID | table SESSIONID, action, product_name
transaction command: startswith / endswith : To form transactions based on terms, field values or evaluations, use startswith & endswith options
Example: the first event in the transaction includes addtocart & the last event includes purchase
index=* sourcetype=access* | transaction clientip \
startswith=action="addtocart" endswith=action="purchase"
In your case, you need to use the last shown example.
NOTE: Use transaction when you need to see events correlated together and also must define event grouping based on start / end values.