https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396928#M172822 <P>So, you want all events that are not part of that transaction? Can you be a bit more clear on what output you expect to get?</P> Mon, 25 Feb 2019 14:10:30 GMT FrankVl 2019-02-25T14:10:30Z https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396927#M172821 <P>i have query like below and got result</P> <P>index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m</P> <P>now i want to display the result opposite of this</P> <P>index=ABC host=xyz123 NOT ( | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m)</P> <P>how to achieve this?</P> Mon, 25 Feb 2019 14:00:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396927#M172821 logloganathan 2019-02-25T14:00:56Z https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396928#M172822 <P>So, you want all events that are not part of that transaction? Can you be a bit more clear on what output you expect to get?</P> Mon, 25 Feb 2019 14:10:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396928#M172822 FrankVl 2019-02-25T14:10:30Z https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396929#M172823 <P>i have completed the task</P> <P>index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0</P> Mon, 25 Feb 2019 16:07:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396929#M172823 logloganathan 2019-02-25T16:07:00Z https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396930#M172824 <P>thanks for your response but i have completed the query by myself.</P> <P>Please find the answer </P> Mon, 25 Feb 2019 16:08:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396930#M172824 logloganathan 2019-02-25T16:08:21Z https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396931#M172825 <P>Great, thanks for sharing the solution!</P> Mon, 25 Feb 2019 16:35:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396931#M172825 FrankVl 2019-02-25T16:35:39Z https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396932#M172826 <P>I want this solution should help others..thanks..</P> Mon, 25 Feb 2019 16:45:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-NOT-in-Transaction-command/m-p/396932#M172826 logloganathan 2019-02-25T16:45:31Z