Splunk Search

How to use NOT in Transaction command

logloganathan
Motivator

i have query like below and got result

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m

now i want to display the result opposite of this

index=ABC host=xyz123 NOT ( | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m)

how to achieve this?

Tags (1)
0 Karma
1 Solution

logloganathan
Motivator

i have completed the task

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0

View solution in original post

logloganathan
Motivator

i have completed the task

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0

FrankVl
Ultra Champion

Great, thanks for sharing the solution!

logloganathan
Motivator

I want this solution should help others..thanks..

0 Karma

FrankVl
Ultra Champion

So, you want all events that are not part of that transaction? Can you be a bit more clear on what output you expect to get?

0 Karma

logloganathan
Motivator

thanks for your response but i have completed the query by myself.

Please find the answer

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...