Total a field in a transaction

[approachct]

I have a transaction that is tied together based on IP address in a web server log. The IP is c_ip and the search would look something like the below -

index=iis sourcetype=iis-w3c (cs_method=POST cs_uri_stem=/page1) OR (cs_uri_stem=/page2) | transaction c_ip maxspan=12s startswith="cs_method=POST cs_uri_stem=/pagea" endswith="cs_method=GET cs_uri_stem=/pageb" | search linecount>1 duration="1"

There is a field that exists in each log entry called time_taken. I would like to create a value called TotalTime= time_taken of PageA + time_taken of PageB of the defined transaction. How do I do this? Basically how to I get the value of a field that exists in each log entry inside a transaction when they both have the same name?

Thanks

[bbingham]

if the values are marked as multivalue fields, you can pass them through the transaction command using the mvlist flag. After they are both listed on the transaction, you can then use streamstats to add them even-though they are the same name.

index=iis sourcetype=iis-w3c (cs_method=POST cs_uri_stem=/page1) OR (cs_uri_stem=/page2) 
| transaction c_ip maxspan=12s startswith="cs_method=POST cs_uri_stem=/pagea" endswith="cs_method=GET cs_uri_stem=/pageb"  mvlist=time_taken
| streamstats sum(time_taken) as Total_Time_Taken window=1

this would mean if page1 has time_taken=1 and page2 has time_taken=2, the resulting transaction will have 2 time_taken fields, one marked 1 and one marked 2. Streamstats will then create a new field "Total_Time_Taken" and add all occurrences of "time_taken", resulting in a value of 3.

[stefano_guidoba]

thanks pal, this solved precisely my issue 🙂

[acdevlin]

Just to double-check: Is pageA always guaranteed to be the first event in the transaction and pageB always guaranteed to be the last?