How to return events based on if else rules

[rijk]

I have events like these:

20131212 17:59:07@VE@SANL31 EHDB 121755 CCA@06240@EHAM@ @E 4.47N52.18@Successfully completed
20131212 17:57:17@VE@SANL31 EHDB 121755 @06240@EHAM@ @E 4.47N52.18@Successfully completed

These events belong together because they have the same MessageTime (121755). Using the following subsearch I can return them in pairs:

[search sourcetype="brem" sanl31 eham Successfully completed (cc*) | fields MessageTime] sanl31 eham Successfully completed

How can I refine this search in order to only return the one containing CCA when there is no message not containing the CCA? In this example no event should be returned because both appear. If however the second event was not there I want to keep the first one.

[richgalloway · Accepted solution]

Maybe a transaction will help.

sourcetype="brem" sanl31 eham Successfully completed | transaction MessageTime | where eventcount = 1 | ...

[rijk]

Thanks, indeed no subsearches but transactions.