Splunk Search

why a transaction is still formed when it does not satisfy the "startswith" or "endswith" criteria

myli12
Path Finder

I constructed transactions with "startswith" and "endswith" and I am trying to identify those incomplete transactions by using keepevicted=true. I would expect those incomplete transactions should have either "startwith" condition/event or "endswith" condition/event. I found that the splunk outputs some transactions that satisfy neither "startwith" nor "endswith" condition/event.

For example, the following search string

"A" "B" "C" "D" "E" | dedup _raw | transaction startswith ="A" endswith="B" keepevicted=true | NOT "A" AND NOT "B"

gives me one or two transactions. Since the transactions do not match my startswith or endswith criteria, I am just wondering why/how they are generated as transactions.

Tags (1)

ak
Path Finder

have you tried using unifyends=t as an option for your transaction command?

gkanapathy
Splunk Employee
Splunk Employee

keep_evicted keeps transactions that do not meet the criteria, but just marks them with a closed_txn value of 0.

0 Karma

myli12
Path Finder

I understand keep_evicted = true keeps the incomplete transactios that do not satisfy all the transaction conditions, in my case, do not satisfy Both startswith AND endswith. However, It should satisfy either. My question is why there are transactions formed when not meeting Either startswith OR endswith condition?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...