How do you reference the value of a transaction

[adylent]

Does anyone know if it is possible to reference the value of a transaction?

For instance

transaction account  startswith="event_type=login" endswith="event_type=logout" 

At this point I should have events encapsulating full user sessions (per account). Can I reference the value of a transaction?

Ideally I'd like to do something like

rex field=transaction mode=sed "s/oldvalue/newvalue/g"  

without have to do this on the _raw prior to the transaction.

Thanks greatly

[kristian_kolb · Accepted solution]

After the transaction command, all events that make up the transaction are stored in the _raw field. The old _raw is gone. Of course, events are only changed for the duration of the search - and not changed on disk.

Try it out, just as you wrote it, but remove the field=transaction part.

... | transaction account  startswith="event_type=login" endswith="event_type=logout" 
| rex mode=sed "s/oldvalue/newvalue/g"

/k