Extract InProgress Transaction

[manvi_spl8]

I want to filter out transactions(where status ="InProgress ") that started in the previous slot and those completed in the next slot. basically if earliest=04/27/2021:12:0:0 and latest=04/28/2021:12:0:0 I want to display only those transactions which started in the specified period and are in completed status.

I have a previous query like this :

stats earliest(_time) as InTime ,latest(_time) as OutTime,

values(eval(if(code="E100" OR code="E101" OR code="E102"))) as error,

count(eval(code="E010")) as messageReceived, count(eval(code="E030" OR code="E031")) as messageCompleted | sort - InTime

[ITWhisperer]

What defines a transaction? Do all the events for a transaction have the same unique correlation id?

[manvi_spl8]

All the transactions have unique Id

[ITWhisperer]

Assuming code=E010 is your start and either E101 or E102 is your end, gather all the codes for the transaction on each event and then search for the events which have E010 and either E101 or E102, then calculate your stats from these events.

| eventstats values(code) as allcodes by transactionid
| search allcodes="E010" (allcodes="E030" OR allcodes="E031")
| stats earliest(_time) as InTime ,latest(_time) as OutTime,
values(eval(if(code="E100" OR code="E101" OR code="E102"))) as error,
count(eval(code="E010")) as messageReceived, count(eval(code="E030" OR code="E031")) as messageCompleted | sort - InTime