Transaction with uri and referer in apache access

[geoff1]

Hi,
I have a Apache access log,for events in every transaction,the referer field of the second event will be the same as uri of the first event, which looks like this:

clientip [timestamp] - - - GET uri1 ... referer1 ...

clientip [timestamp] - - - GET uri2 ... referer2=uri1 ...

clientip [timestamp] - - - GET uri3 ... referer3=uri2 ...

Can I make a transaction based on clientip, uri, referer?

Thanks,
Geoff

[kristian_kolb]

transaction does not work quite that way. The point of specifying more than one field to base the transaction on, is to allow it to span across different types of log, e.g.

• logs from system_1 contains fieldA=xxx fieldB=yyy
• logs from system_2 contains fieldB=yyy fieldC=zzz
• logs from system_3 contains fieldC=zzz fieldD=qqq

Then you can link it together with transaction fieldB fieldC.

In your case you only have a single source of events, but the values on which you want to build your transaction moves between fields. It would be infinitely easier to use a session-id or similar.

/K

[geoff1]

Thanks Kolb. Yes I know if the events are in different sourcetypes, it could be eazier to correlate them. But I don't have a session-id in the access log now. Any other commands can get a similiar result as I want?