Splunk Search

transaction search: how to determine unresolved "start of problem" events

Path Finder


In my application, i use a file to store problems: when happen and when resolve. When a problem happen, more that one device will find it and record the information. But when a problem is solved, just one message is written to that log file.

For example, a segment of the log file is as the following:

2010/07/01 08:01:00 AAA [err] complains "can not find the apple 0001"
2010/07/01 08:01:00 BBB [err] complains "apple 0001 is not there"
2010/07/01 08:01:01 CCC [err] complains "apple 0001 is moved to a new place"
2010/07/01 08:02:00 Main[info] broadcasts "apple 0001 is placed to the right place"

Now, I want to get those unresolved problems.

I used transaction to do this before, and use startwith="can not find " OR "is not there" OR "is moved to a new place". But just as in the example, the first event ("can not find the apple 0001") is treated as an unresolved problem.

Any questions for this question?

Thanks & Regards,


Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Seems to me that you need transaction on whatever field contains "apple 0001" and an "endswith" of the conclusion, then just keep evicted transactions and report only on the evicted ones.

0 Karma

Splunk Employee
Splunk Employee

From your sample, it sounds as though "apple 0001" in combination with a NOT operator for "placed to the right place" could find the right transaction. Without exact event details this cannot be answered very well.

0 Karma

Splunk Employee
Splunk Employee

Your question is very unclear. Can you provide examples of the transaction you know is successful, and which ones are NOT successful (resolution wise).

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...