Pair events 4778 & 4779

[eranhauser]

How do I pair events 4778 & 4779 for the same Logon_ID when I have multi 4778 and multi 4779?
I would like to pair the first 4779 event (disconnect) with the first 4778 event (reconnect) and than do the same for the second 4779 event with the second 4778 event etc'

[yuanliu]

Sounds like you are looking for transaction.  Something like

| transaction Logon_ID startswith=Event_ID==4778 endswith=Event_ID==4779