Finding many events not linked to a single end event

[jmowat]

I have a bunch of incoming events that either link to a single outcome event or don't link. I'm interested in determining all the events that don't link to the outcome event. For example:

• Tx 1, event="message_received", id="A"
• Tx 2, event="message_received", id="A"
• Tx 3, event="message_received", id="B"
• Tx 4, event="message_received", id="A"
• ...
• Tx 20, event="batch_send_success", id="B"

​I would like to run a search to determine which events have not been sent; in the case above, all the events with id="A" do not have a corresponding event="batch_send_success", id="A" event, so I would like to show Tx 1, Tx 2, and Tx 4 in the search.

I tried using transaction with keepevicted=true, but that doesn't seem to work for many-to-one linkage transactions like I am trying; it works in reverse and ends up considering all "message_received" with the exception of the most recent one as evicted and gives me false negatives.

Thanks in advance for any help!

[richgalloway · Accepted solution]

Try using stats.

index=foo
| stats values(*) as * by id
| where isnull(mvfind(event, "batch_send_success"))

The stats command combines all "event" fields with the same id.  Then mvfind is used to find those that don't contain (returns NULL) "batch_send_success".