Splunk Search

search currently running jobs

sarora
New Member

If my transaction logs START AND END as mentioned below then I know my transaction completed. But I want to find out transactions that have started but not ended. And I want to do that by looking for PID that have START but no END. How do I write this search query?

INFO 2014-04-10 05:16:16 15696 19126260 [ClassA]: START JOB1
INFO 2014-04-10 05:16:16 15696 19126260 [ClassA]: Perform STEP 1
INFO 2014-04-10 05:16:18 15696 19126260 [ClassA]: Perform STEP 2
INFO 2014-04-10 05:16:18 15696 19126260 [ClassA]: Perform some more STEPS
INFO 2014-04-10 05:16:18 15696 19126260 [ClassA]: END JOB1

Thanks.

Tags (1)
0 Karma

somesoni2
Revered Legend

Try this (assuming PID is an extracted field)

your base search | transaction keeporphans=t PID startswith="START" endswith="END" | where isnull(closed_txn)

This should give all the events which are not part of a completed transaction. You can further summarize as per your need.

0 Karma

sarora
New Member

Thanks for the help.

It didn't work as-is. So I made few adjustments.

base serahc | transaction keepevicted=true pid startswith="START" endswith="END" | search closed_txn=0

This will include transactions that don't start with "START". I want where it always start with "START".

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...