Our application's log-entries are in JSON and I need to search for certain strings found in the field called message.
I have no problem finding them with a regular search:
... AND (message="Application is closing." OR message="successfully started")
However, when I try to define a transaction with the seemingly same search criteria:
...
| transaction source startsWith="message=\"Application is closing.\"" endsWith="message=\"successfully started\""
I get zero results... Am I escaping the quotes incorrectly or making some other syntax error?
Hi
have you try this?
https://community.splunk.com/t5/Splunk-Search/transaction-startswith-match-not-exact/m-p/102410
r. Ismo
Can you post sample events (scrambled)?
Here is the sample:
12/21/21 7:43:43.000 PM | { logger: connectivity.runner.Runner message: Managed service successfully started severity: INFO thread: main time: 1640133823.948 }
|
12/21/21 7:42:02.000 PM | { logger: connectivity.core.shutdown.GracefulShutdownStrategy message: Application is closing. Running commands will end with partial results. severity: WARN thread: Thread-6 time: 1640133722.085 }
|