Only Listing Transactions with Multiple Events

[epw0rrell]

I am interested in only listing transactions of a given source entity that contain multiple events.  Is there a quick and easy way to do this?

index=main | transaction src_entity startswith=at least one thing endswith=another thing | table src dst etc.

[epw0rrell]

Work perfect thanks!!

[epw0rrell]

Thanks, that is definitely the answer to that question but now looking at the results, I see that I need to be more specific and only display transactions where a certain field has more than one "event" value if that makes sense?  Thanks for your help and is there a way I can do this? 

[bowesmana · Accepted solution]

To count multiple values of fields, use mvcount, i.e.

| where mvcount(fieldname)>1

 and a 'value' in the field will be the set of distinct values found for that field in the transaction, e.g. see this simple example

| makeresults count=20
| streamstats c
| eval _time=_time-c
| sort - _time
| eval id2=ceil(c/2)
| eval id3=random() % 5
| eval id=if(c<9,"123","456")
| transaction id
| eval c_id2=mvcount(id2), c_id3=mvcount(id3)

[bowesmana]

If you're just looking for number of events that make up the transaction, then the transaction command adds a field called eventcount to each of the results, so you can just do

| where eventcount>1

Please note that transaction command has a number of issues when dealing with large data sets or long running spans between connected events and you will not see errors when using the command, only 'odd' things happening and random behaviour.

transaction has its uses, but often the same can be achieved with the stats command