hi,
I want to find out transactions which does not satisfy endswith condition
This is my search
index=tm_idx host="server" sourcetype="TM_Test_10" | transaction startswith="Start Session" endswith="server is coming down"
Thanks and Regards
Add in | search closed_txn=0
to the end.
Note that there are lots of other ways that this query might be written; more detail is requested.
You might also make your search more efficient by having the initial search only search for the relevant events instead of all of them:
index=tm_idx host="server" sourcetype="TM_Test_10" ("Start Session" OR "server is coming down")
Can you provide more detail, with some sample events? How much time might exist between these events? When you run the search, do you get a message saying that some of the events were evicted (blue banner)?
Have you tried the tips here?
http://answers.splunk.com/answers/445/finding-uncompleted-transactions
hi its giving me no results found