Splunk Search

Problem with transaction command

ChhayaV
Communicator

hi,
I want to find out transactions which does not satisfy endswith condition

This is my search
index=tm_idx host="server" sourcetype="TM_Test_10" | transaction startswith="Start Session" endswith="server is coming down"

Thanks and Regards

Tags (2)
0 Karma

sowings
Splunk Employee
Splunk Employee

Add in | search closed_txn=0 to the end.

Note that there are lots of other ways that this query might be written; more detail is requested.

sowings
Splunk Employee
Splunk Employee

You might also make your search more efficient by having the initial search only search for the relevant events instead of all of them:

index=tm_idx host="server" sourcetype="TM_Test_10" ("Start Session" OR "server is coming down")

0 Karma

sowings
Splunk Employee
Splunk Employee

Can you provide more detail, with some sample events? How much time might exist between these events? When you run the search, do you get a message saying that some of the events were evicted (blue banner)?

Have you tried the tips here?

http://answers.splunk.com/answers/445/finding-uncompleted-transactions

0 Karma

ChhayaV
Communicator

hi its giving me no results found

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...