Searching by Transaction TYPE

[mikefoti]

The following query finds what I would call "RejectedTrasnactions"

index="radius"  | transaction nps_Class maxspan=1s startswith=(eventtype=nps_accessRequested) endswith=(eventtype=nps_accessReqRejected)| timechart count by nps_callingStation

I use a similar query to find "AcceptedTrasnactions"

If opt to add appropriate code to transactions.conf, is there a way to gather stas based on transaction types? For example, would a query like this show me how many of each transaction type occurred per time period?

index="radius" |timechart count by transaction

[MarioM · Accepted solution]

it's actually transactiontypes.conf but it only allow to call 1 transaction definition by using "... | transaction name=mytransactiondef ..." and this "name" field doesnot seems to be searchable.

Then i would try a different way either using summary indexing & marker or eval & case function