Does anyone know if it is possible to reference the value of a transaction?
For instance
transaction account startswith="event_type=login" endswith="event_type=logout"
At this point I should have events encapsulating full user sessions (per account). Can I reference the value of a transaction?
Ideally I'd like to do something like
rex field=transaction mode=sed "s/oldvalue/newvalue/g"
without have to do this on the _raw prior to the transaction.
Thanks greatly
After the transaction
command, all events that make up the transaction are stored in the _raw
field. The old _raw
is gone. Of course, events are only changed for the duration of the search - and not changed on disk.
Try it out, just as you wrote it, but remove the field=transaction
part.
... | transaction account startswith="event_type=login" endswith="event_type=logout"
| rex mode=sed "s/oldvalue/newvalue/g"
/k
After the transaction
command, all events that make up the transaction are stored in the _raw
field. The old _raw
is gone. Of course, events are only changed for the duration of the search - and not changed on disk.
Try it out, just as you wrote it, but remove the field=transaction
part.
... | transaction account startswith="event_type=login" endswith="event_type=logout"
| rex mode=sed "s/oldvalue/newvalue/g"
/k