Transaction startswith option

[madan]

I'm using the transaction with startswith to match multiple strings. I want any event that contains either of the strings.

which of the below one is correct ?

index=web "web-thread-"
| transaction txid startswith=(param=121fdfd OR param2=asfdads3232 OR a_inexe_1 OR asdf_1) endswith="web time:" maxspan=10m

index=web "web-thread-"
| transaction txid startswith=("param=121fdfd" OR "param2=asfdads3232" OR "a_inexe_1" OR "asdf_1") endswith="web time:" maxspan=10m

Both of the above produces slightly different results. I would like to know which is correct? 

[manjunathmeti]

hi @madan,
You can also provide search expressions for startswith.
Run this and see which one matches your results.

index=web "web-thread-"
| transaction txid startswith="param=121fdfd OR param2=asfdads3232 OR a_inexe_1 OR asdf_1" endswith="web time:" maxspan=10m