https://community.splunk.com/t5/Splunk-Search/Find-Transaction-time-with-same-startswith-log-string/m-p/162261#M45962 <P>My suggestion would be to create a field called message which will store the message after "System Up -", so that it would be blank/null for 2nd event and you can use that as startswith (different in both entries).</P> <P>something like this</P> <PRE><CODE>Your base search | rex "System Up\s*-\s*(?&lt;message&gt;.*)$" | transaction startswith="System Up AND NOT message=*" endswith="System Up message=*" </CODE></PRE> Tue, 29 Jul 2014 20:23:07 GMT somesoni2 2014-07-29T20:23:07Z https://community.splunk.com/t5/Splunk-Search/Find-Transaction-time-with-same-startswith-log-string/m-p/162260#M45961 <P>Hi,</P> <P>I need to find the transaction time between these 2 statements which has same startswith Log strings(different endswith) and hence its ignoring the first event.</P> <P>2014-07-04 09:48:00-System Up - Node1 is down<BR /> 2014-07-04 09:43:00-System Up</P> <P>How could I find the transaction time between these 2 events.</P> Tue, 29 Jul 2014 19:41:01 GMT https://community.splunk.com/t5/Splunk-Search/Find-Transaction-time-with-same-startswith-log-string/m-p/162260#M45961 sethuk555 2014-07-29T19:41:01Z https://community.splunk.com/t5/Splunk-Search/Find-Transaction-time-with-same-startswith-log-string/m-p/162261#M45962 <P>My suggestion would be to create a field called message which will store the message after "System Up -", so that it would be blank/null for 2nd event and you can use that as startswith (different in both entries).</P> <P>something like this</P> <PRE><CODE>Your base search | rex "System Up\s*-\s*(?&lt;message&gt;.*)$" | transaction startswith="System Up AND NOT message=*" endswith="System Up message=*" </CODE></PRE> Tue, 29 Jul 2014 20:23:07 GMT https://community.splunk.com/t5/Splunk-Search/Find-Transaction-time-with-same-startswith-log-string/m-p/162261#M45962 somesoni2 2014-07-29T20:23:07Z