Long-winded expressions in transaction's startsWith

[unitedmarsupial]

Our application's log-entries are in JSON and I need to search for certain strings found in the field called message.

I have no problem finding them with a regular search:

... AND (message="Application is closing." OR message="successfully started")

However, when I try to define a transaction with the seemingly same search criteria:

...
| transaction source startsWith="message=\"Application is closing.\"" endsWith="message=\"successfully started\""

I get zero results... Am I escaping the quotes incorrectly or making some other syntax error?

[isoutamo]

Hi

have you try this?

https://community.splunk.com/t5/Splunk-Search/transaction-startswith-match-not-exact/m-p/102410

r. Ismo

[unitedmarsupial]

---

@isoutamo wrote:

have you tried this?

---

Sorry, I don't see, how it would help me -- my problem is not, that only a substring is matched... Our log-entries are structured (JSON) and, consequently, the search-string contains quotes of its own.

[isoutamo]

Can you post sample events (scrambled)?

[unitedmarsupial]

Here is the sample:

12/21/21 7:43:43.000 PM	{    logger: connectivity.runner.Runner    message: Managed service successfully started    severity: INFO    thread: main    time: 1640133823.948 } host = rt22a10031pv00 source = PROD sourcetype = log4j2
12/21/21 7:42:02.000 PM	{    logger: connectivity.core.shutdown.GracefulShutdownStrategy    message: Application is closing. Running commands will end with partial results.    severity: WARN    thread: Thread-6    time: 1640133722.085 } host =rt22a10031pv00 source = PROD sourcetype = log4j2