chaining events together

[gregbujak]

I am trying to figure out the query that would allow me to chain a series of events together. The issue here is that its an order system where the modification generates a new_id and puts the original id in old_id. old_id will be populated only the first modification message.

This can go on multiple times.

T1 new_id=1, old_id=, ...
T2 new_id=1, old_id=, ...
T3 new_id=2, old_id=1, ...
T4 new_id=2, old_id, ...
T5 new_id=3, old_id=2, ...
T6 new_id=3, old_id=,...
T7 new_id=3, old_id=,...

Modifications happen at T3,T5. Since all these events are technically part of a single conversation, is there a straight forward way to join a possible ENDLESS chain of these together? Any help would help.

I dont believe transaction addresses this particular case.

[3no]

Hey !

I don't know exactly what you are expecting as output...but I think this should do the job :

index=index sourcetype=sourcetype
| eventstats values(old_id) AS A by new_id
| rename new_id AS B
| eval C=A+","+B
| eval new_id=if(isnull(C),B,C)
| makemv delim="," new_id
| transaction new_id

3no.

[_d_]

If old_id exists on the start event, this should do it:

| transaction new_id startswith=(old_id=*)

EDIT: the above, single transaction will isolate only changes. To "chain" those changes together try something like this:

..| eval my_id=if(isnotnull(old_id), "bar" , '') | transaction new_id startswith=(old_id=*) | transaction my_id

[_d_]

Ah okay...try the edit above.

[gregbujak]

All the events in this example are from a single conversation/transaction.

I dont think this accounts for the iterative nature of this type of conversation and the initial messages with null old_id

[martin_mueller]

The way I understand it, the example in the question is one conversation/transaction. When a new new_id is generated, it's supposed to be chained to the old new_id through the now filled old_id field.

[_d_]

That's what the problem statement is, correct? "where the modification generates a new_id and puts the original id in old_id"

[martin_mueller]

Wouldn't this open a new transaction every time the new_id is changed?