Transaction without endswith

[martinhelgegren]

Hi! Filtering data from an amount of hosts looking for downtime durations. I get a "forensic" use view with this search string:

index=myindex host=* | rex "to state\s(?<mystate>.*)" | search mystate="DOWN " OR mystate="UP | transaction by host startswith=mystate="DOWN " endswith=mystate="*UP " | table host,duration,_time | sort by duration | reverse

...where I REX for the specific patterns of "to state " (host transition into another state, in this example "DOWN" or "UP"), I had do do another "search" to get only the specific ones as there are more than DOWN/UP states (due to my anonymization of the data). I then can retrieve the duration between transitions using "duration" and sorting it as I please.

My question - if I'd like to look into ongoing, "at-this-moment-active" hosts in state "DOWN" ie. replace "endswith" with a nominal time value ("NOW"). Where there yet has not been any "endswith" match, just counting the duration from "startswith" to the present moment - any tips on how I can formulate that properly?

[ITWhisperer]

Have a look at the transaction command option e.g. keeporphans and keepevicted to see if they will give what you need

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

[martinhelgegren]

Unfortunately no, tested them both - separately with each boolean value  and together with both true/true, true/false, false/true and false/false. Does not seem to provide the matching needed.