Is it possible to only return events that have no corresponding start or end transaction event?

[horsefez]

Hi Splunk community,

I'm currently trying to correlate different event sources and events with each other.

My search gives me the following results:

Event A
Event B
Event A
Event B
Event B <---
Event A
Event B
Event A
Event B
etc.

You can see that there is one Event B that has no Event A in front of it.

Can I somehow tell Splunk to only show events where the Event is only B and no A before or only A and no B afterwards?

I know about transaction, but I don't know how to only show results that do not match a transaction condition.

Any suggestions to solve this without transactions?

---

Thank you in advance!

Regards,
pyro_wood

[HeinzWaescher]

Without transaction it could look like this by using the streamstats command:

| streamstats last(event) AS previous_event current=f window=1
| search event="B" AND previous_event!="A"

[somesoni2]

You can include filter for event=A as well here. Like
....
| search (event="B" AND previous_event!="A") OR (event="A" AND previous_event!="B")

[horsefez]

Thank you for your suggestions!
I'll try them aswell!

[sundareshr · Accepted solution]

Assuming you have used transaction command and grouping appears right, you can use the keepevicted & closed_txn options to show events that are not grouped. So your command will look something like this

.... | transaction <unique_field> startswith=abc endswith=xyz keepevicted=t | table _raw closed_txn | where closed_txn=1

[gmartinn]

keepevicted=true

[horsefez]

Wow! :)))))))

Keepevicted is such a useful parameter. I almost gave up, not finding any solution.
Thank you, you literally made my day! 🙂