How to write a complex transaction Search

[vasanthmss]

Hi There,

Identify the transaction duration based on individual field, field3,fiel4 values. Events may not be same as below sample, events may be indexed like a,b,a,a,a,b,b,c.

Transaction Rule,

Transaction starts when the events field1, field2 has 1,0 with continuous field1,fiel2 has 1,1 then pick the first event time.
Transaction ends with either field1,fiel2 has 8,0 or 9,0.

Sample Events,

time    field   field1 field2 field3 field4 
.   a   1   0   xx  xx *
.   a   1   1   xx  xx 
    a   1   0   xx  xx
    a   2   1   xx  xx
    a   1   0   xx  xx  
    a   9   0   xx  xx *

    a   1   0   xy  xx *
    a   1   1   xy  xx
    a   1   0   xy  xx
    a   2   1   xy  xx
    a   1   0   xy  xx  
    a   8   0   xy  xx *

    b   1   0   xx  xx *
    b   1   0   xx  xx  
    b   1   0   xx  xx
    b   1   1   xx  xx
    b   x   x   xx  xx
    .
    .
    .
    b   9   8   xx  xx
    b   8   0   xx  xx *

Expected Results,

field   fiele2  field3  duration
a   xx      xx      10:00
a   xy      xy      5:00
b   xx      xx      15:00

[emiller42 · Accepted solution]

You didn't explicitly mention it, but it's implied by your example, that the transaction is grouped on field. (a, b, c, etc) That being the case, the below should work for you. The startswith and endswith params are treated like searches when surrounded by parens, which lets this work. Note that depending on how long your transactions actually are, you may need to also set maxevents or maxspan as well.

... | transaction field startswith=(field1=1 AND field2=0) endswith=((field1=8 OR field1=9) AND field2=0)

*note: the AND's in the above are technically redundant, but included for clarity