I have a Apache access log,for events in every transaction,the referer field of the second event will be the same as uri of the first event, which looks like this:
clientip [timestamp] - - - GET uri1 ... referer1 ...
clientip [timestamp] - - - GET uri2 ... referer2=uri1 ...
clientip [timestamp] - - - GET uri3 ... referer3=uri2 ...
Can I make a transaction based on clientip, uri, referer?
transaction does not work quite that way. The point of specifying more than one field to base the transaction on, is to allow it to span across different types of log, e.g.
Then you can link it together with transaction fieldB fieldC.
transaction fieldB fieldC
In your case you only have a single source of events, but the values on which you want to build your transaction moves between fields. It would be infinitely easier to use a session-id or similar.
Thanks Kolb. Yes I know if the events are in different sourcetypes, it could be eazier to correlate them. But I don't have a session-id in the access log now. Any other commands can get a similiar result as I want?