https://community.splunk.com/t5/Splunk-Search/Transaction-without-endswith/m-p/681828#M232985 <P>Have a look at the transaction command option e.g. keeporphans and keepevicted to see if they will give what you need</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction</A></P><P>&nbsp;</P> Mon, 25 Mar 2024 09:27:50 GMT ITWhisperer 2024-03-25T09:27:50Z https://community.splunk.com/t5/Splunk-Search/Transaction-without-endswith/m-p/681821#M232983 <P>Hi! Filtering data from an amount of hosts looking for downtime durations. I get a "forensic" use view with this search string:<BR /><BR /></P> <LI-CODE lang="markup">index=myindex host=* | rex "to state\s(?&lt;mystate&gt;.*)" | search mystate="DOWN " OR mystate="UP | transaction by host startswith=mystate="DOWN " endswith=mystate="*UP " | table host,duration,_time | sort by duration | reverse</LI-CODE> <P>...where I REX for the specific patterns of "to state " (host transition into another state, in this example "DOWN" or "UP"), I had do do another "search" to get only the specific ones as there are more than DOWN/UP states (due to my anonymization of the data). I then can retrieve the duration between transitions using "duration" and sorting it as I please.<BR /><BR />My question - if I'd like to look into ongoing, "at-this-moment-active" hosts in state "DOWN" ie. replace "endswith" with a nominal time value ("NOW"). Where there yet has not been any "endswith" match, just counting the duration from "startswith" to the present moment - any tips on how I can formulate that properly?</P> Tue, 26 Mar 2024 17:53:26 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-without-endswith/m-p/681821#M232983 martinhelgegren 2024-03-26T17:53:26Z https://community.splunk.com/t5/Splunk-Search/Transaction-without-endswith/m-p/681828#M232985 <P>Have a look at the transaction command option e.g. keeporphans and keepevicted to see if they will give what you need</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction</A></P><P>&nbsp;</P> Mon, 25 Mar 2024 09:27:50 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-without-endswith/m-p/681828#M232985 ITWhisperer 2024-03-25T09:27:50Z https://community.splunk.com/t5/Splunk-Search/Transaction-without-endswith/m-p/682034#M233038 <P>Unfortunately no, tested them both - separately with each boolean value&nbsp; and together with both true/true, true/false, false/true and false/false. Does not seem to provide the matching needed.</P> Tue, 26 Mar 2024 17:35:55 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-without-endswith/m-p/682034#M233038 martinhelgegren 2024-03-26T17:35:55Z