Thanks @cusello, meanwhile | transaction startswith="logfail" endswith="login" will provide you the starting and ending event but if i want to capture three or four consecutive events as stated above, for exmaple accept,accept,deny or login,changepassword,logout then whether any command to achieve this, that's my query
if we use transaction command on first and last event we don't have control over the inbetween events and there is a chance it may vary with actual events which we are looking for
... View more