Counting sessions with missing events

[ShagVT]

Hey gang - searching for missing data is probably the weakest part of my Splunk skillset.  I just have a hard time thinking through how to even write such a query. 

I have a transaction that usually goes event_name=A, event_name=B, event_name=C.  But I'm trying to research a situation where B is missing sometimes.  I'd like to be able to build a timechart that shows the number of transactions in which B is missing.   The events in transaction are all linked by a common identifier that we'll call session_id.

I've looked at the transaction command and I suppose I understand that.

index=indexname event_name=A OR event_name=B OR event_name=C | transaction session_id startsWith=A endsWith=C maxspan=10m

But I don't know where to go from here.

[ShagVT]

Your second query here is basically what I was looking for.  To make it work as a timechart I ended up doing this:

index=indexname event_name=A OR event_name=B OR event_name=C
| stats values(event_name) as events earliest(_time) as start latest(_time) as end by session_id
| where isnull(mvfind(events,"B"))
| eval _time=start
| timechart count

THANK YOU!!!

[ITWhisperer · Accepted solution]

Assuming that session_id is unique across transactions, this will tell you when a transaction with fewer than 3 unique events started and finished

index=indexname event_name=A OR event_name=B OR event_name=C
| stats dc(event_name) as events earliest(_time) as start latest(_time) as end by session_id
| where events < 3

 If you specifically want the check event B, you could 

index=indexname event_name=A OR event_name=B OR event_name=C
| stats values(event_name) as events earliest(_time) as start latest(_time) as end by session_id
| where isnull(mvfind(events,"B"))