Splunk Search

transaction search: how to determine unresolved "start of problem" events

Path Finder


In my application, i use a file to store problems: when happen and when resolve. When a problem happen, more that one device will find it and record the information. But when a problem is solved, just one message is written to that log file.

For example, a segment of the log file is as the following:

2010/07/01 08:01:00 AAA [err] complains "can not find the apple 0001"
2010/07/01 08:01:00 BBB [err] complains "apple 0001 is not there"
2010/07/01 08:01:01 CCC [err] complains "apple 0001 is moved to a new place"
2010/07/01 08:02:00 Main[info] broadcasts "apple 0001 is placed to the right place"

Now, I want to get those unresolved problems.

I used transaction to do this before, and use startwith="can not find " OR "is not there" OR "is moved to a new place". But just as in the example, the first event ("can not find the apple 0001") is treated as an unresolved problem.

Any questions for this question?

Thanks & Regards,


Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Seems to me that you need transaction on whatever field contains "apple 0001" and an "endswith" of the conclusion, then just keep evicted transactions and report only on the evicted ones.

0 Karma

Splunk Employee
Splunk Employee

From your sample, it sounds as though "apple 0001" in combination with a NOT operator for "placed to the right place" could find the right transaction. Without exact event details this cannot be answered very well.

0 Karma

Splunk Employee
Splunk Employee

Your question is very unclear. Can you provide examples of the transaction you know is successful, and which ones are NOT successful (resolution wise).

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...