Splunk Search

Why is the transaction command not working?


Hello Everyone...I have the below query and I want to evict transactions that starts with Message arrived but not ending with "ml-ok-to-commit[yes]". With keepevicted command, I am not getting the correct result.

Can someone please confirm where am i lacking ?

index=sara_listener* "INF" source="/sara2001/demi/log/listener-mq-swift-mx-ordr-*-mq-swift-mx-ordr-*.log*" | rex field=source "/sara2001/demi/log/listener-mq-swift-mx-ordr-(?<a_letter_a>.*)-mq-swift-mx-ordr-(?<a_letter>.*).log*"  | rex field=_raw "\[(?<ID>[^\]]*)"   | transaction source startswith="Message arrived" endswith="ml-ok-to-commit[yes]"  keepevicted=true |chart limit=0 count by date_hour
0 Karma

Splunk Employee
Splunk Employee

Looking at the documentation for the transaction command, it looks like your events might not be marked as "evicted" based on matching a "startswith" message.

Ref: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

What incorrect results are you seeing?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!