Hello, I have events that look like this (for a user with id 123): 2021-04-29 14:30:45 Notification Received [User Id:123, location:null, location id:null] 2021-04-29 14:30:22 Response Sent for us...
See more...
Hello, I have events that look like this (for a user with id 123): 2021-04-29 14:30:45 Notification Received [User Id:123, location:null, location id:null] 2021-04-29 14:30:22 Response Sent for user id:123 2021-04-29 14:30:15 Notification Received [User Id:123, location:null, location id:null] 2021-04-29 14:29:56 Notification Received [User Id:123, location:null, location id:null] 2021-04-29 14:29:43 Notification Received [User Id:123, location:null, location id:null] 2021-04-29 14:29:35 Response Sent for user id:123 2021-04-29 14:28:59 Notification Received [User Id:123, location:null, location id:null] I have a query where I am getting transactions that start with a Notification Received message and end with a Response Sent. My query works, but it does not start a transaction with the earliest instance of a starting point. So currently my query would return transactions with the timestamps of: 1) 2021-04-29 14:28:59 and 2021-04-29 14:29:35 2) 2021-04-29 14:30:15 and 2021-04-29 14:30:22 But I want the second transaction to retrieve the below instead: 2021-04-29 14:29:43 and 2021-04-29 14:30:22 Is there a way to do this in a transaction? Or a way to rewrite the query to get this? My query looks like this: index=INDEX host=HOSTNAME sourcetype=SOURCETYPE | rex field=_raw "Notification\sReceived\s\[User\sId:(?<user_id>\d+),\slocation:\w+,\slocation id:\w+\]" | rex field=_raw "Response\sSent\sfor\suser\sid:(?<user_id>\d+)" | where user_id<2000 | sort 0 user_id, -_time | transaction user_id startswith="Notification" endswith="Response" maxopenevents=2 | where duration>0 | rename _time as message_arrival | eval message_arrived_at=strftime(message_arrival, "%Y-%m-%d %H:%M:%S") | eval response_sent_at=strftime(message_arrival + duration, "%Y-%m-%d %H:%M:%S") | table user_id, message_arrived_at, response_sent_at, duration