Hi There,
Identify the transaction duration based on individual field, field3,fiel4 values. Events may not be same as below sample, events may be indexed like a,b,a,a,a,b,b,c.
Transaction Rule,
Transaction starts when the events field1, field2 has 1,0 with continuous field1,fiel2 has 1,1 then pick the first event time.
Transaction ends with either field1,fiel2 has 8,0 or 9,0.
Sample Events,
time field field1 field2 field3 field4
. a 1 0 xx xx *
. a 1 1 xx xx
a 1 0 xx xx
a 2 1 xx xx
a 1 0 xx xx
a 9 0 xx xx *
a 1 0 xy xx *
a 1 1 xy xx
a 1 0 xy xx
a 2 1 xy xx
a 1 0 xy xx
a 8 0 xy xx *
b 1 0 xx xx *
b 1 0 xx xx
b 1 0 xx xx
b 1 1 xx xx
b x x xx xx
.
.
.
b 9 8 xx xx
b 8 0 xx xx *
Expected Results,
field fiele2 field3 duration
a xx xx 10:00
a xy xy 5:00
b xx xx 15:00
You didn't explicitly mention it, but it's implied by your example, that the transaction is grouped on field
. (a, b, c, etc) That being the case, the below should work for you. The startswith
and endswith
params are treated like searches when surrounded by parens, which lets this work. Note that depending on how long your transactions actually are, you may need to also set maxevents
or maxspan
as well.
... | transaction field startswith=(field1=1 AND field2=0) endswith=((field1=8 OR field1=9) AND field2=0)
*note: the AND
's in the above are technically redundant, but included for clarity
You didn't explicitly mention it, but it's implied by your example, that the transaction is grouped on field
. (a, b, c, etc) That being the case, the below should work for you. The startswith
and endswith
params are treated like searches when surrounded by parens, which lets this work. Note that depending on how long your transactions actually are, you may need to also set maxevents
or maxspan
as well.
... | transaction field startswith=(field1=1 AND field2=0) endswith=((field1=8 OR field1=9) AND field2=0)
*note: the AND
's in the above are technically redundant, but included for clarity