how to find event that is outside a transaction

[jgcsco]

The transaction command has been helping me to correlate two events. Is there a way for me to find out the event that is not falling into the transaction?

event1, hostid
event2, hostid

|transaction hostid startswith=event1, endswith=event2

This will give me all the hostid that falls into both event1 and event2. How do I find out the hostid which is ONLY in event1 or event2?

Thanks,

[aholzer · Accepted solution]

I believe the "keeporphans" flag is what you are looking for:

keeporphans=<bool>
Description: Specify whether the transaction command should output the results that are not part of any transactions. The results that are passed through as "orphans" are distinguished from transaction events with a _txn_orphan field, which has a value of 1 for orphan results. Defaults to false.

Got this from the Splunk docs on transactions.

Hope this helps.

[jgcsco]

the keepophans will include hostid that is in both event1 and event2, as well either event1 or event2. However, I am interested in ONLY in event1 or event2.

[aholzer]

@jgsco

Use | search _txn_orphan=1 after the transaction. That should return only the "orphans".

[jgcsco]

Thanks! That worked.