List of events from transactions starting with A

[daisy_st]

Hi all,

I am using data from 3 different indexes. They contain events which can be attributed to specific transactions through ID. There are multiple transactions and each transaction contains event from multiple indexes. The transaction can look like 1) event from index 1, 2) event from index 2, 3) event from index 1, etc. I would like to get only events for which the transaction starts with A and ends with B or C. I was thinking to use transaction but it would be way too slow to get the events. I was trying to work out with stats but I end up getting all events, not only the events that start with A and end with B or C.  The result should be also list of events, i.e. no chart or visualizations. Any ideas?

(index=x) OR (index=y) OR (index=z)
| stats list(*) as * by ID Time   | fields - a,b,c

[daisy_st]

hi, I actually found another workaround. The point was to get the specific status as part of each transaction included transaction and afterwards getting the data back in raw event format with matching events only. For example, all events for transactions which contain ERROR code need to be displayed, even if the given event doesn't contain the code but the transaction does. Thanks for making me check further eventstats, that helped.

index=x OR index=y OR index=z 
| eventstats count(eval(Status="A")) AS Count_Status list(Status) AS VALUES min(_time) AS min_time  BY  ID| where Count_Status>0  

[ITWhisperer]

(index=x) OR (index=y) OR (index=z)
| eventstats first(index) as lastindex last(index) as firstindex by ID
| where firstindex=x and (lastindex=y or lastindex=z)

Assumes events are latest first