Splunk Search

Why is the transaction command not working?

ramprakash
Explorer

Hello Everyone...I have the below query and I want to evict transactions that starts with Message arrived but not ending with "ml-ok-to-commit[yes]". With keepevicted command, I am not getting the correct result.

Can someone please confirm where am i lacking ?

index=sara_listener* "INF" source="/sara2001/demi/log/listener-mq-swift-mx-ordr-*-mq-swift-mx-ordr-*.log*" | rex field=source "/sara2001/demi/log/listener-mq-swift-mx-ordr-(?<a_letter_a>.*)-mq-swift-mx-ordr-(?<a_letter>.*).log*"  | rex field=_raw "\[(?<ID>[^\]]*)"   | transaction source startswith="Message arrived" endswith="ml-ok-to-commit[yes]"  keepevicted=true |chart limit=0 count by date_hour
0 Karma

ccl0utier
Splunk Employee
Splunk Employee

Looking at the documentation for the transaction command, it looks like your events might not be marked as "evicted" based on matching a "startswith" message.

Ref: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

What incorrect results are you seeing?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...