I have the data in the following format
Msg Id Event Timestamp ( Format Example)
123 A 24/06/2019 10:02
123 B 24/06/2019 10:02
123 C 24/06/2019 10:02
123 D 24/06/2019 10:02
123 E 24/06/2019 10:02
125 A 24/06/2019 10:02
125 B 24/06/2019 10:02
125 C 24/06/2019 10:02
126 X 24/06/2019 10:02
126 E 24/06/2019 10:02
127 A 24/06/2019 10:02
127 B 24/06/2019 10:02
127 C 24/06/2019 10:02
127 D 24/06/2019 10:02
127 E 24/06/2019 10:02
I need to find a transaction that is not yet complete for last 15 minutes using pattern matching. i.e I need to check transactions that begin with A, has C and not E and from current time how long since the event C is generated. I tried something but getting weird results like non evicted transactions are also coming in my search output
Search |transaction msgid startswith="A" endswith="E" mvlist=t, keepevicted=true|search closed_txn=0|eval find_orphan_ind=mvfind(event,"C")|search find_orphan_ind=*|eval my_missed_msg=mvindex(timestamp,find_orphan_ind)
