We're troubleshooting a problem with our web app where a synchronous job queue stops executing after an indeterminate amount of uptime, requiring the app to be restarted. We think we've found the culprit after discovering a couple of instances where a particular job appears to have gotten stuck, and never logged its completion, which seems to coincide with two recent occurrences of the problem (normal logging continues, except for these queued jobs). How can I get Splunk to return a collection (transaction?) of a certain number of lines in the log starting with search string A (the message that indicates the beginning of the job), but only where that sequence of lines does not also contain search string B (the message that confirms successful completion of the job)?
