capture specific sequence of events

[michaelrosello]

I have these set of event based on transaction But I only want to compute a specific sequence of events and discard the rest.

Here is the criteria for the sequence of what I want to capture.

1. should start with pageDefault
2. followed by 1 or 2 occurence of pageChange
3. followed by 3 or 4 occurrence of listRead

[gcusello]

hi michaelrosello,
filter events before and after transaction, something like this:

index=my_index (page=pageDefault OR page=pageChange OR page=listRead)
| transaction startswith="pageDefault "
| search page=pageChange page=listRead
| table _time url page response_time

Bye.
Giuseppe

[cpetterborg]

Do you want to go from one pageDefault to the next pageDefault, but only those ending with listRead? And that would mean that the first four pageDefault entries would be thrown out. Or do you want to go from the first pageDefault through to at least the last in the set of listRead entries? That will make a big difference.

[michaelrosello]

There should only be one set of events that I should capture. So based on my screenshot. the sequence of pageDefault,pageChange,pageChange,listRead,listRead,listRead will be computed and the rest thrown out.