How to get transaction to ignore endswith if startswith doesn't exist

[mikecal]

I have an issue where my transaction search finds endswith events with no startswith events.

Not to go into too much detail but this is due to a funky way that Cisco logs OSPF events when DMVPN is involved.

I want to simply ignore endswith matches if a startswith event doesn't exist.

Is there a way to force transaction to only match if a startswith event exists (must startswith)?

Below is my search:

sourcetype=cisco:ios eventtype="cisco_ios-routing-ospf" | transaction host startswith="FULL to DOWN" endswith="LOADING to FULL" keepevicted=true | search closed_txn=0

Thanks,
Mike

[woodcock]

Ditch transaction like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="cisco:ios" AND eventtype="cisco_ios-routing-ospf"
| streamstats count(eval(searchmatch(FULL to DOWN"))) AS sessionID
| streamstats count(eval(searchmatch(LOADING to FULL"))) AS endsWithPos BY sessionID
| eventstats count(eval(searchmatch(LOADING to FULL"))) AS endsWithCount BY sessionID
| search endsWithPos = endsWithCount
| stats rante(time) AS duration BY sessionID

[richgalloway]

What are the values of the 'closed_txn' and '_txn_orphan' fields for the transactions missing startswith events? If the former is non-zero, add the keeporphans option to the transaction; if the latter is non-zero, use keepevicted=false.

[mikecal]

Thanks for your reply. The value for keepevicted is non zero and for some reason keeporphans returns no value at. The problem I see with the keepevicted approach is that it cannot distinguish between startswith and endswith. I only want to ignore incomplete transactions where endswith is present with no startswith. However, I do want to know when a startswith value is found and no endswith value is found. When I set keepevicted to false, both endswith and startswith are ignored.