I am trying to figure out the query that would allow me to chain a series of events together. The issue here is that its an order system where the modification generates a new_id and puts the original id in old_id. old_id will be populated only the first modification message.
This can go on multiple times.
T1 new_id=1, old_id=, ...
T2 new_id=1, old_id=, ...
T3 new_id=2, old_id=1, ...
T4 new_id=2, old_id, ...
T5 new_id=3, old_id=2, ...
T6 new_id=3, old_id=,...
T7 new_id=3, old_id=,...
Modifications happen at T3,T5. Since all these events are technically part of a single conversation, is there a straight forward way to join a possible ENDLESS chain of these together? Any help would help.
I dont believe transaction addresses this particular case.
Hey !
I don't know exactly what you are expecting as output...but I think this should do the job :
index=index sourcetype=sourcetype
| eventstats values(old_id) AS A by new_id
| rename new_id AS B
| eval C=A+","+B
| eval new_id=if(isnull(C),B,C)
| makemv delim="," new_id
| transaction new_id
3no.
If old_id exists on the start event, this should do it:
| transaction new_id startswith=(old_id=*)
EDIT: the above, single transaction will isolate only changes. To "chain" those changes together try something like this:
..| eval my_id=if(isnotnull(old_id), "bar" , '') | transaction new_id startswith=(old_id=*) | transaction my_id
Ah okay...try the edit above.
All the events in this example are from a single conversation/transaction.
I dont think this accounts for the iterative nature of this type of conversation and the initial messages with null old_id
The way I understand it, the example in the question is one conversation/transaction. When a new new_id is generated, it's supposed to be chained to the old new_id through the now filled old_id field.
That's what the problem statement is, correct? "where the modification generates a new_id and puts the original id in old_id"
Wouldn't this open a new transaction every time the new_id is changed?