Answer by warren for Is their a way to exclude a transaction if one of its event contain the string “error” on Splunk

Put your condition of NOT "[error]" in your initial search like this:

index=ndx sourcetype=srctp transid=* eventcount=* NOT "[error]"
| transaction transid endswith="completed OK."
| stats count by eventcount
| eval fcount=eventcount*count
| stats sum(fcount)

from User warren – Stack Overflow https://stackoverflow.com/questions/73784530/is-their-a-way-to-exclude-a-transaction-if-one-of-its-event-contain-the-string/73788880#73788880
via IFTTT