I'm using the transaction with startswith to match multiple strings. I want any event that contains either of the strings. which of the below one is correct ? index=web "web-thread-" | transaction txid startswith=(param=121fdfd OR param2=asfdads3232 OR a_inexe_1 OR asdf_1) endswith="web time:" maxspan=10m index=web "web-thread-" | transaction txid startswith=("param=121fdfd" OR "param2=asfdads3232" OR "a_inexe_1" OR "asdf_1") endswith="web time:" maxspan=10m Both of the above produces slightly different results. I would like to know which is correct?
... View more