Splunk Search

How to edit a transaction search with multiple "endswith" option?

srinivasup
Explorer

hi,

i have a search to get duration of the job, let's say startswith=started endswith=success
But in some case the job may fail, now it should be enddswith=FAILURE

now i want to write single search to get SUCCESS OR FAILURE JOB and their duration, starttime, endtime and status

Ex:

| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS" -- this is only for success

| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS or FAILURE" - ITS NOT WORKING

Tags (2)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Transaction
endswith
Syntax:
endswith=
Description: A search or eval expression which, if satisfied by an event, marks the end of a transaction.

Updated one...Try this one -
| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS" OR "STATUS: FAILURE"

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Can you just use STATUS:? If s, then just do:

| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS:"

It could be a problem if you have other lines with STATUS:, but only in that case.

0 Karma

somesoni2
Revered Legend

How about this?

| transaction JOB startswith="EVENT: STARTJOB" endswith="(STATUS: SUCCESS) OR (STATUS: FAILURE)"
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...