How to edit a transaction search with multiple "endswith" option?

[srinivasup]

hi,

i have a search to get duration of the job, let's say startswith=started endswith=success
But in some case the job may fail, now it should be enddswith=FAILURE

now i want to write single search to get SUCCESS OR FAILURE JOB and their duration, starttime, endtime and status

Ex:

| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS" -- this is only for success

| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS or FAILURE" - ITS NOT WORKING

[inventsekar]

https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Transaction
endswith
Syntax:
endswith=
Description: A search or eval expression which, if satisfied by an event, marks the end of a transaction.

Updated one...Try this one -
| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS: SUCCESS" OR "STATUS: FAILURE"

[cpetterborg]

Can you just use STATUS:? If s, then just do:

| transaction JOB startswith="EVENT: STARTJOB" endswith="STATUS:"

It could be a problem if you have other lines with STATUS:, but only in that case.

[somesoni2]

How about this?

| transaction JOB startswith="EVENT: STARTJOB" endswith="(STATUS: SUCCESS) OR (STATUS: FAILURE)"