Splunk Search

How to use NOT in Transaction command

logloganathan
Motivator

i have query like below and got result

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m

now i want to display the result opposite of this

index=ABC host=xyz123 NOT ( | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m)

how to achieve this?

Tags (1)
0 Karma
1 Solution

logloganathan
Motivator

i have completed the task

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0

View solution in original post

0 Karma

logloganathan
Motivator

i have completed the task

index=ABC host=xyz123 | transaction startswith="failure" endswith="success" maxevents=2 maxspan=1m keepevicted=true | search closed_txn=0

View solution in original post

0 Karma

FrankVl
Ultra Champion

Great, thanks for sharing the solution!

logloganathan
Motivator

I want this solution should help others..thanks..

0 Karma

FrankVl
Ultra Champion

So, you want all events that are not part of that transaction? Can you be a bit more clear on what output you expect to get?

0 Karma

logloganathan
Motivator

thanks for your response but i have completed the query by myself.

Please find the answer

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!