How to use NOT in Transaction command

[logloganathan]

i have query like below and got result

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m

now i want to display the result opposite of this

index=ABC host=xyz123 NOT ( | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m)

how to achieve this?

[logloganathan · Accepted solution]

i have completed the task

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0

[FrankVl]

Great, thanks for sharing the solution!

[logloganathan]

I want this solution should help others..thanks..

[FrankVl]

So, you want all events that are not part of that transaction? Can you be a bit more clear on what output you expect to get?

[logloganathan]

thanks for your response but i have completed the query by myself.

Please find the answer