https://community.splunk.com/t5/Splunk-Search/If-an-event-with-quot-removed-quot-appears-how-to-exclude-all/m-p/195708#M56426 <P>Perhaps something like this?</P> <PRE><CODE>search index=applicationX sourcetype=application | transaction ID maxspan=350000s | where NOT like(REASON,"% removed %") | chart stuff ... </CODE></PRE> <P>I removed REASON from the transaction command so all events with the same ID will be in the same transaction. Then the <CODE>where</CODE> command should eliminate transactions with "remove" in the REASON field.</P> Mon, 19 Jan 2015 14:38:48 GMT richgalloway 2015-01-19T14:38:48Z https://community.splunk.com/t5/Splunk-Search/If-an-event-with-quot-removed-quot-appears-how-to-exclude-all/m-p/195707#M56425 <P>The events look like this: </P> <PRE><CODE>DATE=2015-01-19;TIME=10:34:20;STATUS=INFO;ID=57689;JOB=;ACTION=updateCounter;REASON=NotDigital DATE=2015-01-19;TIME=10:34:20;STATUS=INFO;ID=30689;JOB=;ACTION=updateCounter;REASON=NotDigital DATE=2015-01-19;TIME=10:34:20;STATUS=INFO;ID=57689;JOB=;ACTION=updateCounter;REASON=Digital DATE=2015-01-19;TIME=10:34:20;STATUS=INFO;ID=30689;JOB=;ACTION=updateCounter;REASON=Digital </CODE></PRE> <P>I do group them in a transaction (transaction ID, REASON).<BR /> It does happen that the ORDER gets deleted by the application owner. Then I do have the following event: </P> <PRE><CODE>DATE=2015-01-09;TIME=14:04:30;STATUS=INFO; JOB=HousekeepingTask;ACTION=deleteFromFileSystem;REASON=Order 30689 removed from file system by user example </CODE></PRE> <P>search looks like</P> <PRE><CODE>search Index=applicationX sourcetype=application | transaction ID, REASON maxspan=350000s | chart stuff ... </CODE></PRE> <P>I know I could remove them from the results with <CODE>NOT ID=XXXYYY</CODE>, but I need to remove them as soon the orders are removed by the Application.</P> <P>Thank you very much for any suggestion.</P> Mon, 19 Jan 2015 13:12:29 GMT https://community.splunk.com/t5/Splunk-Search/If-an-event-with-quot-removed-quot-appears-how-to-exclude-all/m-p/195707#M56425 spsdoit 2015-01-19T13:12:29Z https://community.splunk.com/t5/Splunk-Search/If-an-event-with-quot-removed-quot-appears-how-to-exclude-all/m-p/195708#M56426 <P>Perhaps something like this?</P> <PRE><CODE>search index=applicationX sourcetype=application | transaction ID maxspan=350000s | where NOT like(REASON,"% removed %") | chart stuff ... </CODE></PRE> <P>I removed REASON from the transaction command so all events with the same ID will be in the same transaction. Then the <CODE>where</CODE> command should eliminate transactions with "remove" in the REASON field.</P> Mon, 19 Jan 2015 14:38:48 GMT https://community.splunk.com/t5/Splunk-Search/If-an-event-with-quot-removed-quot-appears-how-to-exclude-all/m-p/195708#M56426 richgalloway 2015-01-19T14:38:48Z https://community.splunk.com/t5/Splunk-Search/If-an-event-with-quot-removed-quot-appears-how-to-exclude-all/m-p/195709#M56427 <P>Thank you. This won't work because you example removes only the event (or transaction) with removed in it.<BR /> As you can see, the REASON field has different value. I tried that.<BR /> The search needs to somehow get the ID from in the remove-event in a variable and then NOT ID like... <BR /> Sorry if my explanation is misleading.</P> Mon, 19 Jan 2015 14:47:16 GMT https://community.splunk.com/t5/Splunk-Search/If-an-event-with-quot-removed-quot-appears-how-to-exclude-all/m-p/195709#M56427 spsdoit 2015-01-19T14:47:16Z https://community.splunk.com/t5/Splunk-Search/If-an-event-with-quot-removed-quot-appears-how-to-exclude-all/m-p/195710#M56428 <P>According to the manual, the where command should remove the entire transaction.<BR /> The key is making sure all events with the same ID are the same transaction. That is why I use only the ID field in the transaction command.</P> Mon, 19 Jan 2015 16:30:27 GMT https://community.splunk.com/t5/Splunk-Search/If-an-event-with-quot-removed-quot-appears-how-to-exclude-all/m-p/195710#M56428 richgalloway 2015-01-19T16:30:27Z https://community.splunk.com/t5/Splunk-Search/If-an-event-with-quot-removed-quot-appears-how-to-exclude-all/m-p/195711#M56429 <P>Well yes, indeed this will work, need to add a transaction with REASON at the end.:</P> <P>search index=applicationX sourcetype=application | transaction ID maxspan=350000s | where NOT like(REASON,"% removed %") | transaction REASON | chart stuff ...</P> <P>It can happen that I do have have smth like 250000 event's, this will may slow the report down. I will give it a tray to accelerate the search.<BR /> Otherwise, I will summarize, then create the report on the summary index. <BR /> Thank you richgalloway.</P> Thu, 22 Jan 2015 12:44:12 GMT https://community.splunk.com/t5/Splunk-Search/If-an-event-with-quot-removed-quot-appears-how-to-exclude-all/m-p/195711#M56429 spsdoit 2015-01-22T12:44:12Z