Filtering Hosts within a Transaction

[tbrown]

So I have a search that is structured as follows 

index=main <filtering for start and end events> OR <filtering for events within start and end events>  | rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..." | transaction startswith="..." endswith="..."

The rex fields work, the transaction works, etc. However, In the events within the transaction, it pulls from every host that fits the filtering. Basically, I want to limit the transaction to only include the hosts that are listed in the Falling_Node and Rising_Node fields. I've tried adding "host=Falling_Node OR host=Rising_Node" in the "filtering for events within start and end events" but it either clears all events out of the transaction or does nothing.

Does anyone have tips?

[richgalloway]

You can tell the transaction command to use fields when matching up events.  Something like this

index=main <filtering for start and end events> OR <filtering for events within start and end events>  
| rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..." 
| transaction Rising_Node, Falling_Node startswith="..." endswith="..."

[tbrown]

@richgalloway 

That would be a good solution, however only one  event (the last event) in my transactions actually contain the fields "Rising_Node" and "Falling_Node". That means that I can't sort the transaction like you mentioned because it would never find the "startswith" event to make the transactions. Do you have any alternative solutions?

[richgalloway]

Perhaps this?

index=main <filtering for start and end events> OR <filtering for events within start and end events>  
| rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..." 
| where (host=Rising_Node OR host=Falling_Node)
| transaction startswith="..." endswith="..."

[tbrown]

@richgalloway Unfortunately that didn't work either and it returns no results.