Matching the last instance of "endswith" in a transaction?

[lisa_1]

The transaction command matches only the first instance of the specified endswith, however it's possible and likely that the transaction doesn't actually end there. Transaction should match on the last instance, but it doesn't.

Is there a workaround for it? Consider a simple example:


ticket=4000 transaction_type="Create" ticket_status="new"
ticket=4000 transactioon_type="Status" ticket_status="open"
ticket=4000 transaction_type="Status" ticket_status="resolved"
ticket=4000 transactioon_type="Status" ticket_status="open"
ticket=4000 transaction_type="Status" ticket_status="resolved"


As you can see the ticket is opened once (startswith=Create) but resolved twice with someone reopening the ticket in between. A simple endswith=resolved will miss the true resolution of the ticket and all kinds of metrics will be wrong.

Is there a way to workaround this limitation and capture the final ticket_status="resolved" as the true end of the transaction for ticket=4000?

[gkanapathy]

In this case, do you need to use startswith or endswith at all? Can you simply transaction (or stats) on ticket alone?

---

Updated:

If you need to know just the last state and time, you can do either:

ticket=* | transaction ticket mvlist=ticket_status | where mvindex(ticket_status,-1)=="resolved" | eval lastresolvedtime=_time+duration

or

ticket=* | stats last(ticket_status) as last_status,first(_time) as start_time,last(_time) as end_time by ticket | where last_status=="resolved

[gkanapathy]

updated answer

[lisa_1]

One issue is that we have to know that the final status is resolved. Using a transaction may find the ticket simply in the open state or any other non-resolved state. So unfortunately we're forced into knowing the create time and deducing the last resolved time.

[alacercogitatus]

I wouldn't use endswith, since you want all events following "startswith".

How about: |transaction startswith=Create ticket|stats last(ticket_status) by ticket?