Hello all,
The transaction command is not correctly grouping the events in query 1). The expected result is given by query 2). In the end, I need to run the query without the user_id filter which I used just for results validation.
Please, help!
1)
index="myindex" system="mysystem" url="https://myurl/"
| fields _raw, userId, eventDate
| rex field=_raw "(?<session_id_key_value>x-sessionid:[^;]*)"
| eval fields=split(session_id_key_value, ":")
| eval session_id=mvindex(fields, 1)
| rex field=_raw "(?<original_url>X-Original-URL:[^;]*)"
| eval fields=split(original_url, ":")
| eval original_url=mvindex(fields, 1)
| where isnotnull(session_id) AND session_id != "" AND isnotnull(userId) AND userId != ""
| rename userId as user_id
| transaction session_id maxevents=150 keepevicted=true mvlist=true
| where user_id="123456"
| table user_id, session_id, eventcount, duration, eventDate, original_url
Result:
4 events
Eventcounts: 15 (session_id: 123), 3 (session_id: 345), 4 (session_id: 345), 14 (session_id: 345)
eventDates:
04/30/2022 18:57:37 - 04/30/2022 18:57:43,
04/26/2022 20:21:23 - 04/26/2022 20:21:24,
04/26/2022 20:12:04 - 04/26/2022 20:15:43,
04/26/2022 20:01:30 - 04/26/2022 20:01:39,
2)
index="myindex" system="mysystem" url="https://myurl/" userId="123456"
| fields _raw, userId, eventDate
| rex field=_raw "(?<session_id_key_value>x-sessionid:[^;]*)"
| eval fields=split(session_id_key_value, ":")
| eval session_id=mvindex(fields, 1)
| rex field=_raw "(?<original_url>X-Original-URL:[^;]*)"
| eval fields=split(original_url, ":")
| eval original_url=mvindex(fields, 1)
| where isnotnull(session_id) AND session_id != "" AND isnotnull(userId) AND userId != ""
| rename userId as user_id
| transaction session_id maxevents=150 keepevicted=true mvlist=true
| table user_id, session_id, eventcount, duration, eventDate, original_url
2 events
Eventcounts: 15 (session_id: 123), 21 (session_id: 345)
eventDates:
04/30/2022 18:57:37 - 04/30/2022 18:57:43,
04/26/2022 20:01:30 - 04/26/2022 20:21:24
Thanks!
