https://community.splunk.com/t5/Splunk-Search/How-to-edit-a-transaction-search-with-multiple-quot-endswith/m-p/304200#M91469 <P><A href="https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Transaction">https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Transaction</A><BR /> endswith<BR /> Syntax: <BR /> endswith=<BR /> Description: A search or eval expression which, if satisfied by an event, marks the end of a transaction.</P> <P>Updated one...Try this one - <BR /> | transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS" OR "STATUS: FAILURE"</P> Sun, 21 May 2017 07:25:30 GMT inventsekar 2017-05-21T07:25:30Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-a-transaction-search-with-multiple-quot-endswith/m-p/304197#M91466 <P>hi,</P> <P>i have a search to get duration of the job, let's say <CODE>startswith=started endswith=success</CODE><BR /> But in some case the job may fail, now it should be <CODE>enddswith=FAILURE</CODE></P> <P>now i want to write single search to get SUCCESS OR FAILURE JOB and their duration, starttime, endtime and status</P> <P>Ex: </P> <P><CODE>| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS"</CODE> -- this is only for success</P> <P><CODE>| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS or FAILURE"</CODE> - ITS NOT WORKING</P> Fri, 19 May 2017 19:52:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-a-transaction-search-with-multiple-quot-endswith/m-p/304197#M91466 srinivasup 2017-05-19T19:52:01Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-a-transaction-search-with-multiple-quot-endswith/m-p/304198#M91467 <P>How about this?</P> <PRE><CODE>| transaction JOB startswith="EVENT: STARTJOB" endswith="(STATUS: SUCCESS) OR (STATUS: FAILURE)" </CODE></PRE> Fri, 19 May 2017 20:02:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-a-transaction-search-with-multiple-quot-endswith/m-p/304198#M91467 somesoni2 2017-05-19T20:02:22Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-a-transaction-search-with-multiple-quot-endswith/m-p/304199#M91468 <P>Can you just use <CODE>STATUS:</CODE>? If s, then just do:</P> <PRE><CODE>| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS:" </CODE></PRE> <P>It could be a problem if you have other lines with <CODE>STATUS:</CODE>, but only in that case.</P> Fri, 19 May 2017 20:04:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-a-transaction-search-with-multiple-quot-endswith/m-p/304199#M91468 cpetterborg 2017-05-19T20:04:20Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-a-transaction-search-with-multiple-quot-endswith/m-p/304200#M91469 <P><A href="https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Transaction">https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Transaction</A><BR /> endswith<BR /> Syntax: <BR /> endswith=<BR /> Description: A search or eval expression which, if satisfied by an event, marks the end of a transaction.</P> <P>Updated one...Try this one - <BR /> | transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS" OR "STATUS: FAILURE"</P> Sun, 21 May 2017 07:25:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-a-transaction-search-with-multiple-quot-endswith/m-p/304200#M91469 inventsekar 2017-05-21T07:25:30Z