Linking outbound and inbound messages, then finding incomplete ones

[wardallen]

I am analysing a logfile where there'll be a message that describes an outbound message going to an external system, and a short period of time later, a reciprocal message from the external system - a "job done" message, containing a unique deal ID common to both.
Finding the out and in messages won't be hard.
The hard part will be writing a query that tells me about all deal IDs that have an outbound but not an inbound component. What would be the best approach to do this?

[kristian_kolb · Accepted solution]

I can think of at least the following (where deal_ID would be the field that contains the ... deal ID);

... | transaction deal_ID | where eventcount < 2

and slightly faster:

... | stats count by deal_ID | where count < 2

/K

[kristian_kolb]

The first search will return the whole outbound event, and the second search will just return the deal_ID of the lonely outbound event.

/k

[wardallen]

Also, there will be other pairs starting/finishing at the same time. Processing is not linear.