how to use transaction to Group multiple events with field values in a specific order

[qiuxiaoping]

hello , i have many logs like:

"_time1 user=A eventid =45"

"_time2 user=A eventid=46"

"_time3 user=A eventid=48"

"_time4 user=B eventid=45"

"_time5 user=A eventid=46"

i want to transaction new event like:

"_time1 user=A eventid=45

_time2 user=A eventid=46

_time3 user=A eventid=48"

[to4kawa]

 what is the conditions?

[qiuxiaoping]

hello

conditions are:

if user=A, and The eventid values of the three events are 45, 46 and 48 in sequence，then group this three event。

[to4kawa]

index=_internal 
| head 5 
| fields _time _raw 
| reverse 
| streamstats count 
| eval _raw="user=".if(count=4,"B","A")." eventid=".mvindex(split("45.46.48.45.46","."),count - 1)
| fields - count
| kv 
| rename COMMENT as "this is sample" 
| transaction user maxevents=3

see the command reference.

[qiuxiaoping]

Thankyou for your help. i try your sample case . but it does not meet my request. In my request, 45, 46, and 48 must appear strictly in this order . I have added some content based on yours.  pls help me .

index=_internal
| head 10
| fields _time _raw
| reverse
| streamstats count
| eval _raw="user=".if(count=8,"B","A")." eventid=".mvindex(split("45.46.48.45.48.48.46.48.45.46","."),count -1 )
| fields -count
| kv
| rename COMMENT as "this is sample"
| transaction user maxevents=3

[qiuxiaoping]

hello

conditions are:

if user=A, and The eventid values of the three events are 45, 46 and 48 in sequence，then group this three event。