Splunk Search

How to use NOT in Transaction command

logloganathan
Motivator

i have query like below and got result

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m

now i want to display the result opposite of this

index=ABC host=xyz123 NOT ( | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m)

how to achieve this?

Tags (1)
0 Karma
1 Solution

logloganathan
Motivator

i have completed the task

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0

View solution in original post

logloganathan
Motivator

i have completed the task

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0

FrankVl
Ultra Champion

Great, thanks for sharing the solution!

logloganathan
Motivator

I want this solution should help others..thanks..

0 Karma

FrankVl
Ultra Champion

So, you want all events that are not part of that transaction? Can you be a bit more clear on what output you expect to get?

0 Karma

logloganathan
Motivator

thanks for your response but i have completed the query by myself.

Please find the answer

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...