Splunk Search

How to use NOT in Transaction command

logloganathan
Motivator

i have query like below and got result

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m

now i want to display the result opposite of this

index=ABC host=xyz123 NOT ( | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m)

how to achieve this?

Tags (1)
0 Karma
1 Solution

logloganathan
Motivator

i have completed the task

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0

View solution in original post

logloganathan
Motivator

i have completed the task

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0

FrankVl
Ultra Champion

Great, thanks for sharing the solution!

logloganathan
Motivator

I want this solution should help others..thanks..

0 Karma

FrankVl
Ultra Champion

So, you want all events that are not part of that transaction? Can you be a bit more clear on what output you expect to get?

0 Karma

logloganathan
Motivator

thanks for your response but i have completed the query by myself.

Please find the answer

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...