Hello Everyone...I have the below query and I want to evict transactions that starts with Message arrived but not ending with "ml-ok-to-commit[yes]". With keepevicted command, I am not getting the correct result.
Can someone please confirm where am i lacking ?
index=sara_listener* "INF" source="/sara2001/demi/log/listener-mq-swift-mx-ordr-*-mq-swift-mx-ordr-*.log*" | rex field=source "/sara2001/demi/log/listener-mq-swift-mx-ordr-(?<a_letter_a>.*)-mq-swift-mx-ordr-(?<a_letter>.*).log*" | rex field=_raw "\[(?<ID>[^\]]*)" | transaction source startswith="Message arrived" endswith="ml-ok-to-commit[yes]" keepevicted=true |chart limit=0 count by date_hour