Am I using the transaction command correctly?

[Craigrow]

I have a log which is tracking objects as they get moved around by a state machine. The log records a timestamp, the GUID of the object that was moved and the to and from states for the object.

When the state machine moves object to state=foo, this is the beginning of the transaction I want to see. Then the object will then cycle between states foo and bar for some time. Eventually they leave state=foo and go to a state other than foo or bar. That is the end of the transaction.

This is the search that I wrote. When I look at these transactions I'm not seeing what I expected. Am I doing this correctly?

transaction ObjectGUID startswith(ToState=foo AND FromState!=bar) endswith(FromState=foo AND ToState!=bar)

[Craigrow]

Got it. Thanks!

[_d_]

You're missing equal signs. startswith and endswith options need to be followed by =

Example dataset:

Tue Nov 26 19:25:51 EST 2013 ToState=foo FromState=qux objectGUID=abc
Tue Nov 26 19:25:52 EST 2013 ToState=bar objectGUID=abc
Tue Nov 26 19:25:53 EST 2013 ToState=foo objectGUID=abc
Tue Nov 26 19:25:54 EST 2013 ToState=bar objectGUID=abc
Tue Nov 26 19:25:55 EST 2013 ToState=foo objectGUID=abc
Tue Nov 26 19:25:56 EST 2013 ToState=baz FromState=foo objectGUID=abc
Tue Nov 26 19:25:57 EST 2013 ToState=qux objectGUID=abc
Tue Nov 26 19:25:58 EST 2013 ToState=baz objectGUID=abc
Tue Nov 26 19:25:59 EST 2013 ToState=qux objectGUID=abc
Tue Nov 26 19:26:00 EST 2013 ToState=baz objectGUID=abc
Tue Nov 26 19:26:01 EST 2013 ToState=qux objectGUID=abc
Tue Nov 26 19:26:02 EST 2013 ToState=baz objectGUID=abc

index=main | transaction objectGUID startswith=(ToState=foo AND FromState!=bar) endswith=(FromState=foo AND ToState!=bar)

Results:

Tue Nov 26 19:25:51 EST 2013 ToState=foo FromState=qux objectGUID=abc
Tue Nov 26 19:25:52 EST 2013 ToState=bar objectGUID=abc
Tue Nov 26 19:25:53 EST 2013 ToState=foo objectGUID=abc
Tue Nov 26 19:25:54 EST 2013 ToState=bar objectGUID=abc
Tue Nov 26 19:25:55 EST 2013 ToState=foo objectGUID=abc
Tue Nov 26 19:25:56 EST 2013 ToState=baz FromState=foo objectGUID=abc

[yannK]

Hi Craig, it your question was answered, please check the "accept" icon, it will help the other user to find useful information and reward the person that answered.

[Craigrow]

Got it. Thanks!