How to fetch transactions that do not have a completed events?

[AjayTakur]

How should I fetch those events "started" that are present in the Splunk log and those events "completed" will be not available?

... | transaction build_number,type startswith="started" ..... what needs to be wrote here

[richgalloway]

Try  this

... | transaction build_number,type startswith="started" keepevicted=true
| where closed_txn=0