Problem with transaction command

[ChhayaV]

hi,
I want to find out transactions which does not satisfy endswith condition

This is my search
index=tm_idx host="server" sourcetype="TM_Test_10" | transaction startswith="Start Session" endswith="server is coming down"

Thanks and Regards

[sowings]

Add in | search closed_txn=0 to the end.

Note that there are lots of other ways that this query might be written; more detail is requested.

[sowings]

You might also make your search more efficient by having the initial search only search for the relevant events instead of all of them:

index=tm_idx host="server" sourcetype="TM_Test_10" ("Start Session" OR "server is coming down")

[sowings]

Can you provide more detail, with some sample events? How much time might exist between these events? When you run the search, do you get a message saying that some of the events were evicted (blue banner)?

Have you tried the tips here?

http://answers.splunk.com/answers/445/finding-uncompleted-transactions

[ChhayaV]

hi its giving me no results found