Search for non transaction events

[huaraz]

Hi,

I would like to find out that my transactions are correctly put together so that I don't get invalid transactions if for example a start or stop event get lost.

If I would usually have:

start event;
10 events;
stop event

which would be 1 transaction, but then because of a crash or some other data loss I get

start event;
10 events;
start event;
10 events;
stop event

or

start event;
10 events;
stop event;
10 events;
stop event

How many transactions would I get ? What would I get with:

start event;
10 events;
stop event;
5 events;
start event;
10 events;
stop event

Can I search for everything which is not part of a transaction to identify the 5 events ?

Thank you

Markus

[bbingham · Accepted solution]

transactions have a field labeled "closed_txn", in your example do the following:

|transaction startswith="start event" endswith="end event" keepevicted=t 
| search closed_txn=0

Any transaction that is currently "unfinished" or any event that isn't part of the transaction but still in the stream will be listed.