Hello all,
The transaction command is not correctly grouping the events in query 1). The expected result is given by query 2). In the end, I need to run the query without the user_id filter which I...
See more...
Hello all,
The transaction command is not correctly grouping the events in query 1). The expected result is given by query 2). In the end, I need to run the query without the user_id filter which I used just for results validation.
Please, help!
1)
index="myindex" system="mysystem" url="https://myurl/"
| fields _raw, userId, eventDate
| rex field=_raw "(?<session_id_key_value>x-sessionid:[^;]*)"
| eval fields=split(session_id_key_value, ":")
| eval session_id=mvindex(fields, 1)
| rex field=_raw "(?<original_url>X-Original-URL:[^;]*)"
| eval fields=split(original_url, ":")
| eval original_url=mvindex(fields, 1)
| where isnotnull(session_id) AND session_id != "" AND isnotnull(userId) AND userId != ""
| rename userId as user_id
| transaction session_id maxevents=150 keepevicted=true mvlist=true
| where user_id="123456"
| table user_id, session_id, eventcount, duration, eventDate, original_url
Result:
4 events Eventcounts: 15 (session_id: 123), 3 (session_id: 345), 4 (session_id: 345), 14 (session_id: 345) eventDates: 04/30/2022 18:57:37 - 04/30/2022 18:57:43, 04/26/2022 20:21:23 - 04/26/2022 20:21:24, 04/26/2022 20:12:04 - 04/26/2022 20:15:43, 04/26/2022 20:01:30 - 04/26/2022 20:01:39,
2)
index="myindex" system="mysystem" url="https://myurl/" userId="123456"
| fields _raw, userId, eventDate
| rex field=_raw "(?<session_id_key_value>x-sessionid:[^;]*)"
| eval fields=split(session_id_key_value, ":")
| eval session_id=mvindex(fields, 1)
| rex field=_raw "(?<original_url>X-Original-URL:[^;]*)"
| eval fields=split(original_url, ":")
| eval original_url=mvindex(fields, 1)
| where isnotnull(session_id) AND session_id != "" AND isnotnull(userId) AND userId != ""
| rename userId as user_id
| transaction session_id maxevents=150 keepevicted=true mvlist=true
| table user_id, session_id, eventcount, duration, eventDate, original_url
2 events Eventcounts: 15 (session_id: 123), 21 (session_id: 345) eventDates: 04/30/2022 18:57:37 - 04/30/2022 18:57:43, 04/26/2022 20:01:30 - 04/26/2022 20:21:24
Thanks!