Thanks but the stats command returns statistics and I want events. Basically, here are the steps I want to follow:
1) Find all events that have some string "xyz" in them. This will give a filtered list of conversations.
2) For each of the above conversations, find the earliest transaction id in its respective conversation.
3) Use this transaction id and conversation id pair to search through ALL events (not just the filtered ones in step 1 because the events filtered in step 1 may not contain the events that have the 2 ids and the string "input record" in them) and find the event that has the string "input record" in it along with the conversation id and transaction id pair and do this for all the id pairs found in step 2.
4) Display the events found in step3
So in the end, I want the events not the stats
... View more
I have log file in which each log has a conversationId field and a transactionId field. The logs are of various machines communicating with each other and each communication between the machines is called a conversation. For every conversation there are multiple log entries all having the same conversationId but different transactionId. I want to first find the earliest transactionId for each conversation in my logs and then fetch all the events that have this conversation + transactionId pair and also the string "input record" in it.
How do I go about doing this?
I first tried to use the stats command to get the values of all conversationIds but I dont know how to find the earliest transactionId for each conversation and then iterate this over all the conversationIds returned by the stats command.
... View more