Hi @hexx
Thanks for your solution. I have the same requirement but this solution didn't work for me.
When I add keepevicted=true it shows me 2 events per transaction; transaction started event (with closed_txn=0) and transaction ended event (with closed_txn=1) and when I add | search closed_txn=0 it shows me transaction started event for all transactions - including those that completed successfully. But I want only transactions that do not have a completed event
... | transaction build_number,type startswith="started" endswith="completed" keepevicted=true | search closed_txn = 0
... View more