How to write a search to omit transactions unless the URLs are different in the transaction?

[edookati]

I am using the below query, but i need to omit the transactions unless the URLs are different in the transaction.

index=olb_logs sourcetype="access-API" (URL="/bankapi/session" method=POST ) OR (URL="/bankapi/accounts" method=GET) | transaction sessionID maxspan=3s

Thanks.

[martin_mueller]

Your URLs likely are stored in a multi-value field, so you can exploit that to filter:

... | where mvcount(URL) > 1

Alternatively, if you have to make sure two specific URLs are present, you can again use the multi-value property to filter like this:

... | search URL="/bankapi/session" URL="/bankapi/accounts"

Note, that's using an implicit AND instead of OR... both will yield true for the transactions you want because the MV field contains both values.

[somesoni2]

It would be helpful if you can post some sample events and your expected output of transaction command.

[somesoni2]

Try this

index=olb_logs sourcetype="access-API" (URL="/bankapi/session" method=POST ) OR (URL="/bankapi/accounts" method=GET) | dedup URL| transaction sessionID maxspan=3s

[edookati]

even this is not giving me accurate results.
Thanks a lot, for the response.