Splunk Search

How to create a dual transaction where 'startswith' should start with A or B condition and 'endswith' should be C or D condition?

Venkat_16
Contributor

Hi,

I am trying to transaction a scenario here where startswith should start with A or B condition and endswith should be with C or D condition. example:

Transaction startswith= A or B endswith= C or D
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Venkat_16,

this is possible, look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Transaction in the section Filter string options it says:

<filter-string> Syntax: <search-expression> | (<quoted-search-expression>) | eval(<eval-expression>) 
Description: A search or eval filtering expression which if satisfied by an event marks the end of a transaction. 
<search-expression> Description: A valid search expression that does not contain quotes. 
<quoted-search-expression> Description: A valid search expression that contains quotes. 
<eval-expression> Description: A valid eval expression that evaluates to a Boolean.

This means running something like this will work:

transaction startswith="A OR B" endswith="C OR D" <yourfield>

Don't forget to use a field that will be used to build your transaction.

Hope that helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...