transaction startswith 1, endswith multiple

[leea11]

Hi all, simple question I hope.
I have a system that has one starting event with multiple outputs and I want to find out how long it takes for the system to produce each output. When I use a transaction, it only seems to give me the combination of the input and just one of the outputs, where I actually need all of the outputs.

transaction  activity_id startswith=input_event_name, endswith=output_event_name

Any ideas how I can include all the the outputs? Or is there a much better way to do this?

Many thanks

[wpreston · Accepted solution]

How about using stats instead of transaction? Perhaps something like this:

... your search ... 
| eval StartTime=if(searchmatch("input_event_name"),_time,null()) 
| eval EndTime=if(searchmatch("output_event_name"),_time,null()) 
| stats values(StartTime) as StartTime values(EndTime) as EndTime by activity_id
| mvexpand EndTime
| eval TransactionTime=EndTime - StartTime 

This will give you the activity_id, start time, end time, and duration for every instance of output_event_name. If you need to see other information, just modify the stats statement to include it.

[wpreston]

You're very welcome, happy to help!

[leea11]

A thousand thank yous wpreston, that worked a treat!

[somesoni2]

Can you provide some sample logs?

[richgalloway]

I don't know how to handle that situation in a transaction, but perhaps this will help.

input_event_name | join activity_id max=0 overwrite=false [ search output_event_name ] | ...