https://community.splunk.com/t5/Splunk-Search/Transactions-events-at-the-same-second/m-p/406265#M117434 <P>I am using the transaction command to identify if a report runs over a certain time. Below is my search:</P> <PRE><CODE>| transaction startswith="Start" endswith="Finish" keeporphans=true | where _txn_orphan=1 </CODE></PRE> <P>This primarily is working except there seem to be some false positives. If a report runs and finishes within the same second (which happens if a user forgets a parameter) Splunk is still counting it as orphaned, so _txn_orphan is still 1 but it should be 0 since it actually completed. Has anyone run into this and have a better way or workaround for this? </P> Wed, 30 Sep 2020 00:48:32 GMT aohls 2020-09-30T00:48:32Z https://community.splunk.com/t5/Splunk-Search/Transactions-events-at-the-same-second/m-p/406265#M117434 <P>I am using the transaction command to identify if a report runs over a certain time. Below is my search:</P> <PRE><CODE>| transaction startswith="Start" endswith="Finish" keeporphans=true | where _txn_orphan=1 </CODE></PRE> <P>This primarily is working except there seem to be some false positives. If a report runs and finishes within the same second (which happens if a user forgets a parameter) Splunk is still counting it as orphaned, so _txn_orphan is still 1 but it should be 0 since it actually completed. Has anyone run into this and have a better way or workaround for this? </P> Wed, 30 Sep 2020 00:48:32 GMT https://community.splunk.com/t5/Splunk-Search/Transactions-events-at-the-same-second/m-p/406265#M117434 aohls 2020-09-30T00:48:32Z https://community.splunk.com/t5/Splunk-Search/Transactions-events-at-the-same-second/m-p/406266#M117435 <P>Hi @aohls,</P> <P>You can easily get rid of this by adding to your condition a minimum duration for the transaction. That way all those noisy transaction won't show anymore <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Cheers,<BR /> David</P> Thu, 06 Jun 2019 12:53:26 GMT https://community.splunk.com/t5/Splunk-Search/Transactions-events-at-the-same-second/m-p/406266#M117435 DavidHourani 2019-06-06T12:53:26Z