Does anyone have an explanation for the differences in count with and without eval expression

[gesa_behrens]

Hello,

on searching for discrepancies in my dashboard I was able to cut down the problem to the following to searches. Maybe there is an explanation for it. The difference is in the count of TLSv1.2.

[DavidHourani · Accepted solution]

Hi @gesa_behrens,

This is happening because a single transaction contains sometimes more than one ssl_protocol field values which means that if the condition matches on "-" everything gets replaced by the "HTTP" string.

You might want to run your eval before building the transaction then you'll be good on the count.

Cheers,
David

[gesa_behrens]

wow, that was quick, and now that you mention it, this is absolutely clear to me, should have seen it my self.
Thanks so much!

[DavidHourani]

hahah most welcome 😉