I am using the transaction command to group events being logged to two indexes. I have a common identifier.
However, I only want to include transactions where there are events from both indexes, (Events being initiated from Web). How can I achieve that?
I tried using the join command, but the output from it just confuses me..
I tried using where (isnotnull(uri)), because I know uri will always be set if the transaction consists of events from both indexes. No result returned.
index=* | rename correlationId as CID | transaction CID | where isnotnull(uri) | fields * | table uri, serviceName,operationName,host
Looking at your other question about not all fields being extracted in your transaction, it makes me wonder if uri is not extracted prior to your where command. Try rearranging the search so that | fields * comes before | where isnotnull(uri) and give that a shot.
index=* | rename correlationId as CID | transaction CID | fields * | where isnotnull(uri) | table uri, serviceName,operationName,host
You need to pass more parameters to your transaction command such as startsWith or endsWith, etc.
In any case, I wouldn't use transaction for what you are trying to achieve.
Try the following instead:
index=YOURINDEX_A OR index=YOURINDEX_B
| rename correlationId as CID
| fields CID, uri, serviceName, operationName, host, index
| stats range(_time) as duration, values(index) as index, values(uri) as uri, values(serviceName) as serviceName, values(operationName) as operationName, values(host) as host by CID
| where isnotnull(uri)
| table uri, serviceName, operationName, host
Let me know if that works. If not, can you give us more details about your data and what you are trying to achieve exactly?