Join data inside same logs

[tung62]

I have logs with three fields (1) session_id, (2) login_id, (3) message
- session_id is "key"
- login_id is empty except user first login
e.g.
session_id,login_id,message
session1, loginA, message1
session1,, message2
session1,, message3
session2,loginB, message4

How to join the data to retrieve all events and fields of "sesion1" only using login_id="loginA"?

[markthompson]

You can use the transaction command.

Your search | transaction startswith="login_id='loginA'" endswith="Whatever the last bit of it is"

This will join the string together as one event.

[tung62]

The transaction command will merge contents into a single row. But I want the result is shown as below table format. Can do it?

time,session1,loginA,message1
time,session1,loginA,message2
time,session1,loginA,message3

[markthompson]

If you want to display it as a table, simply use the table command.