topic Close a TRANSACTION with only 1 EVENT in Getting Data In

Close a TRANSACTION with only 1 EVENT

verbal_666 — Tue, 25 May 2021 09:47:49 GMT

Hi.
I would like to unterstand why Splunk does not close a transaction with only 1 event, if i force a STARTSWITH parameter... i tried all possible parameters, but with STARTSWITH there's no way, transaction is dropped...

timestamp ..... user=XXXXXXXXXXXXXX action=login_do from=127.0.0.1 status=failed

.... | transaction maxevents=-1 user from startswith="login_do"

... no events returned...

.... | transaction maxevents=-1 user from

... event cought!!!

Thanks.

Re: Close a TRANSACTION with only 1 EVENT

javiergn — Tue, 25 May 2021 10:53:18 GMT

Hi @verbal_666 ,

Have you tried adding the keepevicted=t first and then keeporphans=t in order to see if any of them are returning anything and if so, find out why that particular transaction is being evicted or treated as an orphan?

Regards,

Re: Close a TRANSACTION with only 1 EVENT

verbal_666 — Tue, 25 May 2021 11:07:33 GMT

I was sure having used all parameters, but maybe i was wrong with some boolean 😑

transaction keepevicted=t keeporphans=t maxevents=-1 startswith="login_do" user from

close the single event transaction... i was sure had used both of them, maybe my mistake!!! Just the "keepevicted=t " is enough.

Thanks a lot!!! 👍

Re: Close a TRANSACTION with only 1 EVENT

verbal_666 — Tue, 25 May 2021 16:10:01 GMT

Sometimes Splunk surprises!!!

The code that tomorrow did not work properly, now works 🙄

transaction keepevicted=f keeporphans=f maxevents=-1 startswith="login_do" user from

Now works!!! I did't change anything in the query... very very strange!!!