I have events like these:
20131212 17:59:07@VE@SANL31 EHDB 121755 CCA@06240@EHAM@ @E 4.47N52.18@Successfully completed
20131212 17:57:17@VE@SANL31 EHDB 121755 @06240@EHAM@ @E 4.47N52.18@Successfully completed
These events belong together because they have the same MessageTime (121755). Using the following subsearch I can return them in pairs:
[search sourcetype="brem" sanl31 eham Successfully completed (cc*) | fields MessageTime] sanl31 eham Successfully completed
How can I refine this search in order to only return the one containing CCA when there is no message not containing the CCA? In this example no event should be returned because both appear. If however the second event was not there I want to keep the first one.
Maybe a transaction will help.
sourcetype="brem" sanl31 eham Successfully completed | transaction MessageTime | where eventcount = 1 | ...
Maybe a transaction will help.
sourcetype="brem" sanl31 eham Successfully completed | transaction MessageTime | where eventcount = 1 | ...
Thanks, indeed no subsearches but transactions.