Splunk Search

Why is the transaction command not working?

ramprakash
Explorer

Hello Everyone...I have the below query and I want to evict transactions that starts with Message arrived but not ending with "ml-ok-to-commit[yes]". With keepevicted command, I am not getting the correct result.

Can someone please confirm where am i lacking ?

index=sara_listener* "INF" source="/sara2001/demi/log/listener-mq-swift-mx-ordr-*-mq-swift-mx-ordr-*.log*" | rex field=source "/sara2001/demi/log/listener-mq-swift-mx-ordr-(?<a_letter_a>.*)-mq-swift-mx-ordr-(?<a_letter>.*).log*"  | rex field=_raw "\[(?<ID>[^\]]*)"   | transaction source startswith="Message arrived" endswith="ml-ok-to-commit[yes]"  keepevicted=true |chart limit=0 count by date_hour
0 Karma

ccl0utier
Splunk Employee
Splunk Employee

Looking at the documentation for the transaction command, it looks like your events might not be marked as "evicted" based on matching a "startswith" message.

Ref: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

What incorrect results are you seeing?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...