Filter transaction

[indeed_2000]

Hi

i have log line like this,

1-need to group by them by ID,

2- filter those transactions that has T[A]

#txn1
16:30:53:002 moduleA ID[123]
16:30:54:002 moduleA ID[123]
16:30:55:002 moduleB ID[123]T[A]
16:30:56:002 moduleC ID[123]

#txn2
16:30:57:002 moduleD ID[987]
16:30:58:002 moduleE ID[987]T[B]
16:30:59:002 moduleF ID[987]
16:30:60:002 moduleZ ID[987]

Any idea?

Thanks

[ITWhisperer]

What fields do you already have extracted?

By "filter" do you mean filter in or filter out i.e. do you want to keep the events with T[A], keep only those events with T[A] or remove them altogether?

[indeed_2000]

@ITWhisperer need to see filter out/in result to decide.

All fields extracted already.

need keep the events with T[A].

[ITWhisperer]

| sort 0 ID

[indeed_2000]

@ITWhisperer ?

[ITWhisperer]

Your events will be together by ID

[indeed_2000]

@ITWhisperer 

How about other part? 

FYI: i mean extract key value one by one with rex command not whole transaction.

[ITWhisperer]

Not sure I understand, you just said all fields already extracted?

[indeed_2000]

@ITWhisperer i mean id, t , … key value extracted not transaction.

[ITWhisperer]

What do you mean by transaction?

[indeed_2000]

@ITWhisperer 

#txn1
16:30:53:002 moduleA ID[123]
16:30:54:002 moduleA ID[123]
16:30:55:002 moduleB ID[123]T[A]
16:30:56:002 moduleC ID[123]

#txn2
16:30:57:002 moduleD ID[987]
16:30:58:002 moduleE ID[987]T[B]
16:30:59:002 moduleF ID[987]
16:30:60:002 moduleZ ID[987]

[ITWhisperer]

How do you determine which events are part of a "transaction"?

[indeed_2000]

@ITWhisperer group by id

[ITWhisperer]

| stats list(_raw) as _raw by ID

[indeed_2000]

@ITWhisperer you miss main question and I tell you step by step main question!

Would you please check main question? And tell me is there any way to do that?

thanks

[ITWhisperer]

| stats list(_raw) as _raw list(T) as T by ID
| where T=="A"