Search same transaction_id in 2 different services.

[onthakur]

Team,

I have a situation where user is calling service 1 and then service1 calls service2 using same transaction_id
sometime it happens that user is calling service 1 but it is not calling service2 and vise versa.

I need a query which will show result in table format and show yes/No if service 1/2 called or not.

transaction_id , service1_status , service2_status.

1234 , yes ,yes

5678, yes, No

Ex :-

log of service 1 :- <timestamp> <transaction_id> <service1 URL>
log of service 2 :- <timestamp> <transaction_id> <service2 URL>

[yuanliu]

Given that a transaction_id would either not exist if a user never calls service 1, or it doesn't matter to your problem, service1_status is superfluous.  Is this correct?  I also do not see service URL as part of required output.  As such, @gcusello's solution can be further simplified.  More than that, I'm not sure if service is an existing field.  On the other hand, the two services are probably logged into different sources or different sourcetypes or both different.  I will assume that service 1 logs into source1 and service 2 logs into source 2.

source IN (source1, source2)
| stats 
     dc(source) AS service_count
     BY transaction_id
| eval status1 = "yes",
     status2=if(service_count > 1,"yes","no")
| table transaction_id status1 status2

[gcusello]

Hi @onthakur ,

you can use something like this:

<your_search>
| stats 
     dc(service) AS service_count
     values(service) AS service
     values(url) AS url
     BY transaction_id
| eval 
     status1=if(service_count=2 OR service_count=1 AND service="service1","yes","not"),
     status2=if(service_count=2 OR service_count=1 AND service="service2","yes","not")
| table transaction_id url status1 status2

Ciao.

Giuseppe

[ITWhisperer]

| chart count by transaction_id, url

Where the count for the url is greater than zero, the service has been called