transaction grouping with startwith and endwith

[xinde]

log format:

start: A
End: A
start: B
End: B
Start: C
Start: D
End: C
End: D
Start:E
End:F

Query I am using:
| rex field=_raw "END:(?.*)"
| transaction processEndName startswith="Start:" endswith="END:" keeporphans=false keepevicted=false
| sort -duration
| head 10
| stats avg(duration) by processEndName

In the return:
A and B can be group together correctly as:
startA
endA
startB
endB

But C and D are messed up:
startD
endC

also E only has starts, F only has ends, but their process name is different, they got grouped together as well:
startE
endF

Is there a way to properly group C/D and exclude E and F?

Thanks in advance!

[mayurr98 · Accepted solution]

Well, I think you are extracting only END process name, you need to extract START as well. As A,B,C,D,so on is your common values(Process names) which will be in both START and END.
Also, put your code in 101010 sample format so that query will display correctly.

well You query is looking absurd so can not give you correct regex but you can try something like this

(END|START):(?<processname>.*)

let me know if this helps!

[xinde]

Thanks man, it works!

[xinde]

Not sure why the query did not display correctly
I got processEndName from the following query
| rex field=_raw "END:(?.*)"