I need to extract the session-duration from different BI server logs. Most BI server logs have clearly defined session-duration fields you can extract by defining extraction logic in props.conf but for one server log, I have to calculate the session using transaction with session id as the field and using eval to assign the duration as session-duration.
But can I do this for only a specific sourcetype ? If not can I do this in the props.conf ?
I think, in props.conf it is not possible. You can try something like this in search
Some search terms... | transaction sessionId | eval SessionDuration = case(sourcetype!="A",SessionDuration,sourcetype=="A",SET-SST)| Other search terms
where SET is 'Session End Time' and SST is 'Session Start Time'