Splunk Search

Search for non transaction events

huaraz
Explorer

Hi,

I would like to find out that my transactions are correctly put together so that I don't get invalid transactions if for example a start or stop event get lost.

If I would usually have:

start event;
10 events;
stop event

which would be 1 transaction, but then because of a crash or some other data loss I get

start event;
10 events;
start event;
10 events;
stop event

or

start event;
10 events;
stop event;
10 events;
stop event

How many transactions would I get ? What would I get with:

start event;
10 events;
stop event;
5 events;
start event;
10 events;
stop event

Can I search for everything which is not part of a transaction to identify the 5 events ?

Thank you

Markus

Tags (1)
0 Karma
1 Solution

bbingham
Builder

transactions have a field labeled "closed_txn", in your example do the following:

|transaction startswith="start event" endswith="end event" keepevicted=t 
| search closed_txn=0

Any transaction that is currently "unfinished" or any event that isn't part of the transaction but still in the stream will be listed.

View solution in original post

0 Karma

bbingham
Builder

transactions have a field labeled "closed_txn", in your example do the following:

|transaction startswith="start event" endswith="end event" keepevicted=t 
| search closed_txn=0

Any transaction that is currently "unfinished" or any event that isn't part of the transaction but still in the stream will be listed.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...