Using the transaction command to group events being logged to two indexes, how do I only include events that are found in both indexes?

[tenorway]

Hi all!

I am using the transaction command to group events being logged to two indexes. I have a common identifier.
However, I only want to include transactions where there are events from both indexes, (Events being initiated from Web). How can I achieve that?
I tried using the join command, but the output from it just confuses me..
I tried using where (isnotnull(uri)), because I know uri will always be set if the transaction consists of events from both indexes. No result returned.

index=* | rename correlationId as CID | transaction CID | where isnotnull(uri) | fields * | table uri, serviceName,operationName,host

Thanks for any assistance!

[tenorway]

Hi There!

I made it work using the coalesque command. That was actually causing the whole problem.
Using the where isnotnull command strips away unwanted transactions.

I would like to use stats, but would that work when not all the fields are present in all the events?

[wpreston]

Looking at your other question about not all fields being extracted in your transaction, it makes me wonder if uri is not extracted prior to your where command. Try rearranging the search so that | fields * comes before | where isnotnull(uri) and give that a shot.

index=* | rename correlationId as CID | transaction CID | fields * | where isnotnull(uri) | table uri, serviceName,operationName,host

[javiergn]

Hi,

You need to pass more parameters to your transaction command such as startsWith or endsWith, etc.
In any case, I wouldn't use transaction for what you are trying to achieve.
Try the following instead:

index=YOURINDEX_A OR index=YOURINDEX_B
| rename correlationId as CID
| fields CID, uri, serviceName, operationName, host, index
| stats range(_time) as duration, values(index) as index, values(uri) as uri, values(serviceName) as serviceName, values(operationName) as operationName, values(host) as host by CID
| where isnotnull(uri) 
| table uri, serviceName, operationName, host

Let me know if that works. If not, can you give us more details about your data and what you are trying to achieve exactly?