How to restrict transaction to group events from the same source and the same host?

[xinde]

• Search a same log file on many different hosts .
• Use transaction : startwith and endwith to capture one process within this log file.

• Show the duration of this process for each host/source

  host="hosts"
  | rex field=_raw "Process(?.*)"
  | transaction ProcessName startswith="BEGIN" endswith="END"
  | eval durationMin = round(duration/60,0)
  | chart values(durationMin) by host
  The search return - msg from different host/source got grouped together.
  Is there a way to restrict transaction events only on same host/source?

[richgalloway · Accepted solution]

Try using stats instead of chart.

host="*hosts*" 
| rex field=_raw "Process(?<ProcessName>.*)" 
| transaction  ProcessName startswith="BEGIN" endswith="END"
| eval durationMin = round(duration/60,0)
| stats values(durationMin) by host, source

If you share some sample events, we may be able to help you improve search performance by eliminating the transaction command.

[xinde]

stats by host , source works!! thanks very much!