Why is the transaction command not working?

[ramprakash]

Hello Everyone...I have the below query and I want to evict transactions that starts with Message arrived but not ending with "ml-ok-to-commit[yes]". With keepevicted command, I am not getting the correct result.

Can someone please confirm where am i lacking ?

index=sara_listener* "INF" source="/sara2001/demi/log/listener-mq-swift-mx-ordr-*-mq-swift-mx-ordr-*.log*" | rex field=source "/sara2001/demi/log/listener-mq-swift-mx-ordr-(?<a_letter_a>.*)-mq-swift-mx-ordr-(?<a_letter>.*).log*"  | rex field=_raw "\[(?<ID>[^\]]*)"   | transaction source startswith="Message arrived" endswith="ml-ok-to-commit[yes]"  keepevicted=true |chart limit=0 count by date_hour

[ccl0utier]

Looking at the documentation for the transaction command, it looks like your events might not be marked as "evicted" based on matching a "startswith" message.

Ref: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

What incorrect results are you seeing?