difference of two values of same field inside a transcation

[KarunK]

Hi ALL,

I am using a transaction command to group two events together, "connect" and "disconnect". Both the events have a common field called bytes and I need to get the difference of the bytes delivered during the disconnect event and connect event.

How can I achieve this ?

(sourcetype="access" event="*connect" status="200") | transaction c_ip eventttype startswith="connect" endswith="disconnect"

Thanks in Advance

Aappreciate your help.

[Ayn · Accepted solution]

Use mvlist=t as a parameter to transaction to make sure you're getting field values in the correct (chronological) order, then use mvindex to get the first and last value for bytes.

... | transaction mvlist=t c_ip eventtype startswith="connect" endswith="disconnect" | eval bytesdiff=tonumber(mvindex(bytes,-1))-tonumber(mvindex(bytes,0))

[KarunK]

Thanks Ayn. It worked....