Splunk Search

How to edit a transaction search with multiple "endswith" option?

srinivasup
Explorer

hi,

i have a search to get duration of the job, let's say startswith=started endswith=success
But in some case the job may fail, now it should be enddswith=FAILURE

now i want to write single search to get SUCCESS OR FAILURE JOB and their duration, starttime, endtime and status

Ex:

| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS" -- this is only for success

| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS or FAILURE" - ITS NOT WORKING

Tags (2)
0 Karma

inventsekar
Ultra Champion

https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Transaction
endswith
Syntax:
endswith=
Description: A search or eval expression which, if satisfied by an event, marks the end of a transaction.

Updated one...Try this one -
| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS" OR "STATUS: FAILURE"

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Can you just use STATUS:? If s, then just do:

| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS:"

It could be a problem if you have other lines with STATUS:, but only in that case.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about this?

| transaction JOB startswith="EVENT: STARTJOB" endswith="(STATUS: SUCCESS) OR (STATUS: FAILURE)"
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...