https://community.splunk.com/t5/Splunk-Search/Problem-with-transaction-command/m-p/61783#M15238 <P>hi,<BR /> I want to find out transactions which does not satisfy endswith condition</P> <P>This is my search <BR /> index=tm_idx host="server" sourcetype="TM_Test_10" | transaction startswith="Start Session" endswith="server is coming down"</P> <P>Thanks and Regards</P> Mon, 28 Sep 2020 14:45:41 GMT ChhayaV 2020-09-28T14:45:41Z https://community.splunk.com/t5/Splunk-Search/Problem-with-transaction-command/m-p/61783#M15238 <P>hi,<BR /> I want to find out transactions which does not satisfy endswith condition</P> <P>This is my search <BR /> index=tm_idx host="server" sourcetype="TM_Test_10" | transaction startswith="Start Session" endswith="server is coming down"</P> <P>Thanks and Regards</P> Mon, 28 Sep 2020 14:45:41 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-transaction-command/m-p/61783#M15238 ChhayaV 2020-09-28T14:45:41Z https://community.splunk.com/t5/Splunk-Search/Problem-with-transaction-command/m-p/61784#M15239 <P>Add in <CODE>| search closed_txn=0</CODE> to the end.</P> <P>Note that there are lots of other ways that this query might be written; more detail is requested.</P> Thu, 12 Sep 2013 13:58:54 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-transaction-command/m-p/61784#M15239 sowings 2013-09-12T13:58:54Z https://community.splunk.com/t5/Splunk-Search/Problem-with-transaction-command/m-p/61785#M15240 <P>hi its giving me no results found</P> Fri, 13 Sep 2013 09:48:33 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-transaction-command/m-p/61785#M15240 ChhayaV 2013-09-13T09:48:33Z https://community.splunk.com/t5/Splunk-Search/Problem-with-transaction-command/m-p/61786#M15241 <P>Can you provide more detail, with some sample events? How much time might exist between these events? When you run the search, do you get a message saying that some of the events were evicted (blue banner)?</P> <P>Have you tried the tips here?</P> <P><A href="http://answers.splunk.com/answers/445/finding-uncompleted-transactions">http://answers.splunk.com/answers/445/finding-uncompleted-transactions</A></P> Tue, 17 Sep 2013 17:00:56 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-transaction-command/m-p/61786#M15241 sowings 2013-09-17T17:00:56Z https://community.splunk.com/t5/Splunk-Search/Problem-with-transaction-command/m-p/61787#M15242 <P>You might also make your search more efficient by having the <EM>initial</EM> search only search for the relevant events instead of all of them:</P> <P>index=tm_idx host="server" sourcetype="TM_Test_10" ("Start Session" OR "server is coming down")</P> Mon, 28 Sep 2020 14:47:36 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-transaction-command/m-p/61787#M15242 sowings 2020-09-28T14:47:36Z