Splunk Search

transaction search: how to determine unresolved "start of problem" events

Path Finder


In my application, i use a file to store problems: when happen and when resolve. When a problem happen, more that one device will find it and record the information. But when a problem is solved, just one message is written to that log file.

For example, a segment of the log file is as the following:

2010/07/01 08:01:00 AAA [err] complains "can not find the apple 0001"
2010/07/01 08:01:00 BBB [err] complains "apple 0001 is not there"
2010/07/01 08:01:01 CCC [err] complains "apple 0001 is moved to a new place"
2010/07/01 08:02:00 Main[info] broadcasts "apple 0001 is placed to the right place"

Now, I want to get those unresolved problems.

I used transaction to do this before, and use startwith="can not find " OR "is not there" OR "is moved to a new place". But just as in the example, the first event ("can not find the apple 0001") is treated as an unresolved problem.

Any questions for this question?

Thanks & Regards,


Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Seems to me that you need transaction on whatever field contains "apple 0001" and an "endswith" of the conclusion, then just keep evicted transactions and report only on the evicted ones.

0 Karma

Splunk Employee
Splunk Employee

From your sample, it sounds as though "apple 0001" in combination with a NOT operator for "placed to the right place" could find the right transaction. Without exact event details this cannot be answered very well.

0 Karma

Splunk Employee
Splunk Employee

Your question is very unclear. Can you provide examples of the transaction you know is successful, and which ones are NOT successful (resolution wise).

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...