Hi
i have log line like this,
1-need to group by them by ID,
2- filter those transactions that has T[A]
#txn1
16:30:53:002 moduleA ID[123]
16:30:54:002 moduleA ID[123]
16:30:55:002 moduleB ID[123]T[A]
16:30:56:002 moduleC ID[123]
#txn2
16:30:57:002 moduleD ID[987]
16:30:58:002 moduleE ID[987]T[B]
16:30:59:002 moduleF ID[987]
16:30:60:002 moduleZ ID[987]
Any idea?
Thanks
What fields do you already have extracted?
By "filter" do you mean filter in or filter out i.e. do you want to keep the events with T[A], keep only those events with T[A] or remove them altogether?
@ITWhisperer need to see filter out/in result to decide.
All fields extracted already.
need keep the events with T[A].
| sort 0 ID
Your events will be together by ID
How about other part?
FYI: i mean extract key value one by one with rex command not whole transaction.
Not sure I understand, you just said all fields already extracted?
@ITWhisperer i mean id, t , … key value extracted not transaction.
What do you mean by transaction?
#txn1
16:30:53:002 moduleA ID[123]
16:30:54:002 moduleA ID[123]
16:30:55:002 moduleB ID[123]T[A]
16:30:56:002 moduleC ID[123]
#txn2
16:30:57:002 moduleD ID[987]
16:30:58:002 moduleE ID[987]T[B]
16:30:59:002 moduleF ID[987]
16:30:60:002 moduleZ ID[987]
How do you determine which events are part of a "transaction"?
@ITWhisperer group by id
| stats list(_raw) as _raw by ID
@ITWhisperer you miss main question and I tell you step by step main question!
Would you please check main question? And tell me is there any way to do that?
thanks
| stats list(_raw) as _raw list(T) as T by ID
| where T=="A"