Splunk Search

How to use NOT in Transaction command

logloganathan
Motivator

i have query like below and got result

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m

now i want to display the result opposite of this

index=ABC host=xyz123 NOT ( | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m)

how to achieve this?

Tags (1)
0 Karma
1 Solution

logloganathan
Motivator

i have completed the task

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0

View solution in original post

logloganathan
Motivator

i have completed the task

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0

FrankVl
Ultra Champion

Great, thanks for sharing the solution!

logloganathan
Motivator

I want this solution should help others..thanks..

0 Karma

FrankVl
Ultra Champion

So, you want all events that are not part of that transaction? Can you be a bit more clear on what output you expect to get?

0 Karma

logloganathan
Motivator

thanks for your response but i have completed the query by myself.

Please find the answer

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...