topic Re: Transaction Command startswith & endswith not working without filtering the events in Splunk Search

Transaction Command startswith & endswith not working without filtering the events

abhinav_maxonic — Tue, 19 Jan 2016 12:08:52 GMT

I am grouping events using the transaction command. Sample search which gives expected results below :
Successful Search:

(index=ind1 OR index=ind2) MachineId=1133 (log_text="*sometext1*" OR log_text="*sometext2*" OR log_text="*sometext3*" OR log_text="*sometext4*" OR log_text="*sometext5*" OR log_text="*sometext6*") | transaction startswith="sometext1" endswith="sometext2" mvlist=true | table _time,log_text

6 log_texts are transactions events.

If I search removing log_text filters, transaction does not work. Sample search below:

Unsuccessful Search:

(index=ind1 OR index=ind2) MachineId=1133 | transaction startswith="sometext1" endswith="sometext2" mvlist=true | table _time,log_text

I am unable to understand this. Can someone please explain?

Re: Transaction Command startswith & endswith not working without filtering the events

javiergn — Tue, 19 Jan 2016 13:11:10 GMT

Try this instead to ensure you are only displaying events where the log_text field has a value:

(index=ind1 OR index=ind2) MachineId=1133 log_text=* | transaction startswith="sometext1" endswith="sometext2" mvlist=true | table _time,log_text

Re: Transaction Command startswith & endswith not working without filtering the events

abhinav_maxonic — Wed, 20 Jan 2016 06:50:49 GMT

Already tried. This is also not working.

Re: Transaction Command startswith & endswith not working without filtering the events

esix_splunk — Wed, 20 Jan 2016 07:31:27 GMT

What version of Splunk are you using? There is a bug in 6.3 regarding the transaction command. (SPL-107742) This was resolved in 6.3.2..

Re: Transaction Command startswith & endswith not working without filtering the events

abhinav_maxonic — Thu, 21 Jan 2016 04:21:40 GMT

I am using Splunk 6.3.0 . So will it work fine in 6.3.2 ?

Re: Transaction Command startswith & endswith not working without filtering the events

esix_splunk — Thu, 21 Jan 2016 04:24:08 GMT

Upgrade to the latest, it should resolve the issue.

Re: Transaction Command startswith & endswith not working without filtering the events

abhinav_maxonic — Thu, 21 Jan 2016 05:18:23 GMT

Ok. I'll try that.

Re: Transaction Command startswith & endswith not working without filtering the events

abhinav_maxonic — Thu, 21 Jan 2016 06:44:15 GMT

Upgrading didn't worked .. Still not getting results. Now using splunk 6.3.2 . Any other suggestion ? or any other possibility or reason, why its not working ..

Re: Transaction Command startswith & endswith not working without filtering the events

javiergn — Thu, 21 Jan 2016 10:09:40 GMT

OK, without knowing what sometext is I would try the following and see if that works:

(index=ind1 OR index=ind2) MachineId=1133 log_text=*
| fields  _time, log_text
| transaction startswith=eval(match(log_text, "sometext1")) endswith=eval(match(log_text, "sometext2")) mvlist=true 
| table _time, log_text

Note the difference in the startswith and endswith filters.