Splunk Search

transaction search: how to determine unresolved "start of problem" events

Path Finder


In my application, i use a file to store problems: when happen and when resolve. When a problem happen, more that one device will find it and record the information. But when a problem is solved, just one message is written to that log file.

For example, a segment of the log file is as the following:

2010/07/01 08:01:00 AAA [err] complains "can not find the apple 0001"
2010/07/01 08:01:00 BBB [err] complains "apple 0001 is not there"
2010/07/01 08:01:01 CCC [err] complains "apple 0001 is moved to a new place"
2010/07/01 08:02:00 Main[info] broadcasts "apple 0001 is placed to the right place"

Now, I want to get those unresolved problems.

I used transaction to do this before, and use startwith="can not find " OR "is not there" OR "is moved to a new place". But just as in the example, the first event ("can not find the apple 0001") is treated as an unresolved problem.

Any questions for this question?

Thanks & Regards,


Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Seems to me that you need transaction on whatever field contains "apple 0001" and an "endswith" of the conclusion, then just keep evicted transactions and report only on the evicted ones.

0 Karma

Splunk Employee
Splunk Employee

From your sample, it sounds as though "apple 0001" in combination with a NOT operator for "placed to the right place" could find the right transaction. Without exact event details this cannot be answered very well.

0 Karma

Splunk Employee
Splunk Employee

Your question is very unclear. Can you provide examples of the transaction you know is successful, and which ones are NOT successful (resolution wise).

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...