Splunk Search

why a transaction is still formed when it does not satisfy the "startswith" or "endswith" criteria

myli12
Path Finder

I constructed transactions with "startswith" and "endswith" and I am trying to identify those incomplete transactions by using keepevicted=true. I would expect those incomplete transactions should have either "startwith" condition/event or "endswith" condition/event. I found that the splunk outputs some transactions that satisfy neither "startwith" nor "endswith" condition/event.

For example, the following search string

"A" "B" "C" "D" "E" | dedup _raw | transaction startswith ="A" endswith="B" keepevicted=true | NOT "A" AND NOT "B"

gives me one or two transactions. Since the transactions do not match my startswith or endswith criteria, I am just wondering why/how they are generated as transactions.

Tags (1)

ak
Path Finder

have you tried using unifyends=t as an option for your transaction command?

gkanapathy
Splunk Employee
Splunk Employee

keep_evicted keeps transactions that do not meet the criteria, but just marks them with a closed_txn value of 0.

0 Karma

myli12
Path Finder

I understand keep_evicted = true keeps the incomplete transactios that do not satisfy all the transaction conditions, in my case, do not satisfy Both startswith AND endswith. However, It should satisfy either. My question is why there are transactions formed when not meeting Either startswith OR endswith condition?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...