Transaction Command startswith & endswith not working without filtering the events

[abhinav_maxonic]

I am grouping events using the transaction command. Sample search which gives expected results below :
Successful Search:

(index=ind1 OR index=ind2) MachineId=1133 (log_text="*sometext1*" OR log_text="*sometext2*" OR log_text="*sometext3*" OR log_text="*sometext4*" OR log_text="*sometext5*" OR log_text="*sometext6*") | transaction startswith="sometext1" endswith="sometext2" mvlist=true | table _time,log_text

6 log_texts are transactions events.

If I search removing log_text filters, transaction does not work. Sample search below:

Unsuccessful Search:

(index=ind1 OR index=ind2) MachineId=1133 | transaction startswith="sometext1" endswith="sometext2" mvlist=true | table _time,log_text

I am unable to understand this. Can someone please explain?

[javiergn]

Try this instead to ensure you are only displaying events where the log_text field has a value:

(index=ind1 OR index=ind2) MachineId=1133 log_text=* | transaction startswith="sometext1" endswith="sometext2" mvlist=true | table _time,log_text

[abhinav_maxonic]

Already tried. This is also not working.

[esix_splunk]

What version of Splunk are you using? There is a bug in 6.3 regarding the transaction command. (SPL-107742) This was resolved in 6.3.2..

[abhinav_maxonic]

I am using Splunk 6.3.0 . So will it work fine in 6.3.2 ?

[esix_splunk]

Upgrade to the latest, it should resolve the issue.

[abhinav_maxonic]

Ok. I'll try that.

[abhinav_maxonic]

Upgrading didn't worked .. Still not getting results. Now using splunk 6.3.2 . Any other suggestion ? or any other possibility or reason, why its not working ..

[javiergn]

OK, without knowing what sometext is I would try the following and see if that works:

(index=ind1 OR index=ind2) MachineId=1133 log_text=*
| fields  _time, log_text
| transaction startswith=eval(match(log_text, "sometext1")) endswith=eval(match(log_text, "sometext2")) mvlist=true 
| table _time, log_text

Note the difference in the startswith and endswith filters.